Google changes how it names cyber threat actors

Google Threat Intelligence Group (GTIG) has implemented a simplified two-word naming system for tracked threat actors following a merger with Mandiant: the first word preserves existing public names or is randomly generated, and the second word denotes category/attribution (e.g., CASTLE for China, ION for Iran, NEPTUNE for North Korea, RELIC for Russia, COMET for cybercrime); existing names and mappings (including MITRE ATT&CK) remain searchable and UNC is retained for uncategorized clusters.