Google Replaces APT Numbers with Two-Word Cryptonyms: SANDWORM RELIC and Beyond

Cybersecurity threat actors have long been tracked by alphanumeric codes like APT44 or UNC6508 — labels that communicate little about who the group is or what motivates them. On July 24, 2026, the Google Threat Intelligence Group (GTIG) announced a unified naming system that replaces those legacy identifiers with intuitive, two-word cryptonyms .

How the Two-Word System Works

The new schema assigns each threat actor a pair of words :

• First word: A unique, memorable identifier for the specific actor. Where possible, this is drawn from existing public reporting (e.g., "Sandworm"); otherwise it is randomly generated and vetted by analysts .
• Second word: A fixed attribution or motivation tag that provides immediate context. The initial categories announced :

Second word	Meaning
CASTLE	People's Republic of China-linked
ION	Iran-linked
NEPTUNE	North Korea-linked
RELIC	Russia-linked
COMET	Cybercriminal

Key Examples and Scope

The most prominent example is the reclassification of the former APT44 / Sandworm as SANDWORM RELIC . GTIG initially prioritized renaming several dozen of the most active groups, with the rest to follow on a rolling basis .

Crucially, backward compatibility is preserved. Previous names remain indexed and searchable in the Google Threat Intelligence platform, and MITRE ATT&CK mappings plus other vendor aliases are maintained . For clusters still in early investigation, GTIG continues to use UNC ("uncategorized") designations .

A New Standard for Threat Actor Naming

Google's move aligns with an industry-wide shift away from opaque sequential codes and toward more descriptive taxonomies. Microsoft uses a weather-themed system, CrowdStrike an animal-themed naming, and Palo Alto Networks a constellation-based approach . Notably, Google proceeded independently rather than joining the cross-vendor naming initiative Microsoft had been leading .

The new system addresses a long-standing pain point for defenders: correlating threat actor names across products, reports, and platforms while trying to respond quickly to incidents.