Google Launches Unified Cryptonym-Based Naming System for Threat Actors

GTIG has launched a unified, two-word cryptonym naming scheme to standardize threat actor identifiers across Google’s security teams, retaining recognizable identifiers where possible and appending a category word (e.g., RELIC for Russia) to convey attribution; Sandworm (APT44) is cited as being renamed to SANDWORM RELIC. The framework preserves legacy aliases and ATT&CK mappings to aid continuity, and organizations are advised to update internal references and detection content as the new cryptonyms propagate.