Google announced on Saturday a new two‑word taxonomy for describing cybercrime groups, creating a distinct term for each actor and a second word that classifies the group’s motive, attribution or activity type. The schema, developed by the Google Threat Intelligence Group that includes the former Mandiant team, was introduced in a blog post to provide consistent naming after years of overlapping labels used by multiple security vendors.

The first word is a unique identifier that Google will reuse if the community has already assigned a name; otherwise it will generate a new term to avoid bias. The second word categorizes threat clusters by motivation, attribution or activity, chosen to aid defensive response.

The taxonomy names include CASTLE for groups linked to the People’s Republic of China, IRON for Iran‑related actors, NEPTUNE for North Korean groups, RELIC for Russian actors and COMET for non‑state cybercriminals. Google said the system is intended to be simple and to align with other existing taxonomies.

The announcement follows earlier industry efforts, notably a 2025 initiative by Microsoft and CrowdStrike to standardize threat‑actor names. Researchers have long used multiple identifiers for the same organization, such as Seashell Blizzard, IRIDIUM, VOODOO BEAR, BE2, UAC‑0113, Blue Echidna, PHANTOM, BlackEnergy Lite and APT44, which all refer to Russia’s Military Intelligence Unit 74455. The proliferation of divergent names complicates coordination across security platforms.

Google noted that Chinese authorities have criticized Western naming conventions for Chinese groups, arguing that terms like “Typhoon,” “Panda” or “Dragon” carry bias, while suggesting neutral names such as “Hurricane” or “Koala.” Google’s approach aims to sidestep such concerns by generating random terms when no community name exists.

The company said the taxonomy will streamline operations and facilitate mapping to other vendor schemas, though it did not indicate whether other firms will adopt the framework. The report concludes without evaluating the effectiveness of the new naming system.