Threat Actor Naming#
Reference of vendor naming conventions for tracked threat actors. Most actors have 4-8 alias names across different vendors; this page maps the conventions and lists notable overlaps so the operator can correlate reporting.
For specific tracked groups, see Hacker Groups. For state-sponsored attribution, see Intelligence Agencies. For ATT&CK technique mapping, see MITRE ATT&CK.
Vendor naming conventions#
Vendor |
Convention |
|---|---|
MITRE ATT&CK |
Group ID (G####) e.g. G0006 = APT1; standard correlation hub. |
Mandiant (Google) |
“APT##” (state-suspected); “FIN##” (financially-motivated); “UNC####” (uncategorised; pre-attribution); “TEMP.<word>” (temporary); occasionally “MULBERRY” / region. |
CrowdStrike |
Animal taxonomy: Bear (RU), Panda (CN), Spider (criminal), Buffalo (VN), Chollima (KP), Tiger (IN), Tsunami (cybercrim emerging), Crane (KR), Ocelot (Latin America), Kitten (IR), Hawk (TR), Lynx (GE), Lion / Lioness (etc), Leopard, Wolf (TR), Jackal (hacktivist). |
Microsoft (renamed 2 |
|
Microsoft (legacy) |
Element table names: PHOSPHORUS (IR), STRONTIUM (RU GRU), NICKEL (CN), HAFNIUM (CN), POLONIUM (LB), THALLIUM (KP), LAZARUS, etc. |
Recorded Future Insi kt |
“RedXxxxxx” (sometimes), or generic descriptor. |
Cisco Talos |
Actor names; “TA###” sometimes; broad descriptor. |
Proofpoint |
“TA###” (Threat Actor); e.g. TA505, TA577, TA453. |
Trend Micro |
Earth + animal: Earth Lusca, Earth Berberoka, Earth Estries. |
Kaspersky |
Names: Equation Group, BlueTraveller, Lazarus, etc. |
ESET |
Names: TeleBots, Sandworm, OutLaw, etc. |
Symantec / Broadcom |
Names: Whitefly, Tortoiseshell, Buckeye / Boyusec, etc. |
SecureWorks |
“Threat Group” naming: TG-3390 / Bronze ##; recently moved to “GOLD” / “BRONZE” / “COBALT” colors. |
PwC |
“Red ###” (Red Castle, Red Wendigo, Red Salamander). |
NCC Group |
Per-incident names. |
Volexity |
Names like StormBamboo, CharmingCypress. |
Group-IB |
Names: RedCurl, Lazarus, etc. |
Trellix / FireEye |
Same as Mandiant lineage. |
Dragos |
“Threat Group” by sector + region: ELECTRUM (RU electric), CHERNOVITE (PIPEDREAM), XENOTIME (TRITON), VOLTZITE. |
Notable overlaps (selected)#
Names |
Notes |
|---|---|
APT28 / Fancy Bear / |
STRONTIUM / FORESTBLIZZARD / Sofacy / Pawn Storm / Sednit / TG-4127 RU GRU 26165. |
APT29 / Cozy Bear / N |
OBELIUM / MIDNIGHTBLIZZARD / Dukes / YTTRIUM RU SVR. |
Sandworm / Voodoo Bea |
r / ELECTRUM / IRON VIKING / Telebots / SEASHELL BLIZZARD RU GRU 74455. |
APT41 / BARIUM / WICK |
ED PANDA / WINNTI / BRONZE ATLAS / DOUBLEDRAGON CN MSS-affiliated; dual espionage + crime. |
APT40 / TA423 / LEVIA |
THAN / GADOLINIUM / KRYPTONITE PANDA / BRONZE MOHAWK CN; maritime targeting. |
APT10 / STONE PANDA / |
MENUPASS / RED APOLLO / POTASSIUM / CICADA / BRONZE RIVERSIDE CN MSS. |
APT3 / GOTHIC PANDA / |
Buckeye / TG-0110 / UPS CN; Equation-derived (US tools captured). |
APT1 / Comment Crew / |
Comment Panda / PLA Unit 61398 CN PLA Unit 61398; Mandiant’s namesake APT. |
Lazarus Group / HIDDE |
N COBRA / ZINC / Diamond Sleet / APT38 (BeagleBoyz) KP RGB Bureau 121. |
Andariel / Onyx Sleet |
/ DarkSeoul / PLUTONIUM KP RGB; banking. |
Kimsuky / Velvet Chol |
lima / Emerald Sleet / THALLIUM / Black Banshee KP intel. |
APT34 / OilRig / Heli |
x Kitten / Crambus / EUROPIUM / Hazel Sandstorm IR MOIS. |
APT33 / Elfin / Refin |
ed Kitten / Peach Sandstorm / HOLMIUM IR. |
APT35 / Charming Kitt |
en / Mint Sandstorm / Phosphorus / Magic Hound IR IRGC. |
MuddyWater / Mango Sa |
ndstorm / Mercury / Static Kitten / TEMP.Zagros IR MOIS. |
Equation Group / Tild |
ed Team / Lamberts US NSA TAO (Snowden / ShadowBrokers). |
Turla / Snake / Venom |
ous Bear / Iron Hunter / Krypton / SECRETBLIZZARD RU FSB Center 16. |
Conti / Wizard Spider |
/ TrickBot / TR / Grim Spider RU criminal. |
LockBit / Bitwise Spi der |
RU criminal. |
ALPHV / BlackCat / Wh |
isker Spider RU criminal. |
FIN7 / Carbanak / Cob |
alt Group / GOLD NIAGARA / TA503 RU/UA criminal. |
Naming ethos / caveats#
Naming ≠ attribution. Names cluster activity; the state-or-individual claim is a separate (often weaker) judgment.
Names can split or merge. Mandiant routinely separates UNC clusters into APTs only after high-confidence attribution; sometimes two APTs collapse into one (or vice versa).
One actor, many names, always cite the vendor name in CTI reports; cross-reference via the ATT&CK G#### group ID.
Microsoft 2023 rename broke a lot of public links; the old element-table names still appear in legacy reporting.
Some “groups” share infrastructure, the TrickBot / Conti / Wizard Spider / Bumblebee cluster is a good example; staff turnover blurs lines.
Avoid actor humanisation, “the threat actor” not “they decided”; attribution opinions vs facts must be delineated.
Vendor bias, each vendor over-represents the actors they see most; a fuller picture comes from triangulating 3+ vendors.
Cross-reference tools#
Tool |
Notes |
|---|---|
ATT&CK Groups |
attack.mitre.org/groups; standard alias correlation. |
ETDA Threat Group Ca rds |
etda.or.th/en/cards; comprehensive group cards. |
MalpediaActor |
malpedia.caad.fkie.fraunhofer.de/actors; Fraunhofer-curated. |
SecureWorks Counter |
secureworks.com/research/threat-profiles; CTU profiles. |
Threat Group Catalog |
github.com/threat-actor-cards-tools. |
Microsoft TA naming |
microsoft.com/en-us/security/blog (Cosmic / Forest / etc.) |
Mandiant attribution |
cloud.google.com/security/intelligence-research. |
Operator notes#
Always cite the vendor + name in CTI artifacts; consumers will need to translate.
Pin to ATT&CK G#### when possible; that’s the only durable correlation.
Watch for “STORM-####”, Microsoft’s uncategorised bucket; still actor-coherent but pre-attribution.
Hacktivist + criminal lines blur, IO actors (KillNet, NoName057(16), Anonymous Sudan, Belarusian Cyber Partisans) often re-grouped under nation-state proxies.
Geofencing, some actors avoid CIS targets (Cyrillic keyboard / language check) to dodge RU LE; vice versa for some IR actors.
Cluster vs group: a “campaign” or “intrusion set” is a weaker grouping than a named “group”; Mandiant uses “UNC####” for unmerged clusters.