Google Replaces APT Numbers with Two-Word Cryptonyms: SANDWORM RELIC and Beyond

• First word: A unique, memorable identifier for the specific actor. Where possible, this is drawn from existing public reporting (e.g., "Sandworm"); otherwise it is randomly generated and vetted by analysts .
• Second word: A fixed attribution or motivation tag that provides immediate context. The initial categories announced :

Key Examples and Scope

The most prominent example is the reclassification of the former APT44 / Sandworm as SANDWORM RELIC . GTIG initially prioritized renaming several dozen of the most active groups, with the rest to follow on a rolling basis .

Crucially, backward compatibility is preserved. Previous names remain indexed and searchable in the Google Threat Intelligence platform, and MITRE ATT&CK mappings plus other vendor aliases are maintained . For clusters still in early investigation, GTIG continues to use UNC ("uncategorized") designations .

A New Standard for Threat Actor Naming

Google's move aligns with an industry-wide shift away from opaque sequential codes and toward more descriptive taxonomies. Microsoft uses a weather-themed system, CrowdStrike an animal-themed naming, and Palo Alto Networks a constellation-based approach . Notably, Google proceeded independently rather than joining the cross-vendor naming initiative Microsoft had been leading .

The new system addresses a long-standing pain point for defenders: correlating threat actor names across products, reports, and platforms while trying to respond quickly to incidents.