{"id":61153,"date":"2026-07-27T07:31:00","date_gmt":"2026-07-27T07:31:00","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5278749"},"modified":"2026-07-27T07:31:00","modified_gmt":"2026-07-27T07:31:00","slug":"google-goes-it-alone-with-a-new-cybercrime-crew-taxonomy","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/google-goes-it-alone-with-a-new-cybercrime-crew-taxonomy\/","title":{"rendered":"Google goes it alone with a new cybercrime crew taxonomy"},"content":{"rendered":"
<\/div>\n
\n

Security<\/p>\n

So much for Microsoft and CrowdStrike\u2019s plans for consistent names across the industry<\/p>\n<\/p><\/div>\n

\n

Google has created a new taxonomy to describe cybercrime outfits, seemingly abandoning a Microsoft-led effort to create consistent names.<\/p>\n

The Big G announced<\/a> its new schema on Saturday in a post that notes its 2022 acquisition of Mandiant<\/a> and its subsequent incorporation into a new team called the Google Threat Intelligence Group (CTIG).<\/p>\n

Now that two have become one, Google reckons they need consistent naming conventions to describe cybercrime crews.<\/p>\n

The result is a two-word schema in which the first word \u201cis a unique and memorable term chosen to represent the specific actor.\u201d If security folk have already applied a particular moniker Google will use it, otherwise it will randomly generate a word \u201cto remove bias.\u201d<\/p>\n

\n
\n

MORE CONTEXT<\/h2>\n<\/p><\/div>\n<\/div>\n

Google says the second word \u201ccategorizes threat clusters by motivation, attribution, or activity type based on which category we consider to be most important for defense and response strategies.\u201d<\/p>\n

More on that later.<\/p>\n

Google has decided on the following names:<\/p>\n