--- title: Google’s top hacker hunter explains why hacking groups... description: Google has revamped its naming system for hacking groups, replacing the old APT numbering scheme inherited from Mandiant with a new format: a memorable first... canonical: https://daily.dev/posts/google-s-top-hacker-hunter-explains-why-hacking-groups-get-codenames-tan0pphmp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google’s top hacker hunter explains why hacking groups get codenames | daily.dev og:description: Google has revamped its naming system for hacking groups, replacing the old APT numbering scheme inherited from Mandiant with a new format: a memorable first... og:url: https://daily.dev/posts/google-s-top-hacker-hunter-explains-why-hacking-groups-get-codenames-tan0pphmp og:image: https://api.daily.dev/og/posts/tAn0ppHmp.png og:image:alt: Google’s top hacker hunter explains why hacking groups get codenames og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google’s top hacker hunter explains why hacking groups get codenames **[TechCrunch](https://daily.dev/sources/tc)** · 4 min read · 1 upvotes · 0 comments ## Summary Google has revamped its naming system for hacking groups, replacing the old APT numbering scheme inherited from Mandiant with a new format: a memorable first name plus a second word whose initial indicates country of origin (Castle for China, Ion for Iran, Neptune for North Korea, Relic for Russia). Shane Huntley, CTO of Google Threat Intelligence Group, explains that consistent naming is essential for defenders to recognize threats, prepare responses, and investigate incidents. Google now tracks over 5,000 activity clusters globally. The fragmentation of naming across companies persists because each organization has different data and telemetry, making a single universal standard impractical. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Google's new naming system for hacking groups? Google's new system gives each hacking group a memorable random first name paired with a second word whose initial letter indicates country of origin: Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia. This replaces the old APT-numbered scheme used by Mandiant and unifies it with the naming previously used by Google's Threat Analysis Group. _Security teams adjusting to new threat actor naming conventions can follow the shift on daily.dev._ ### Why did Mandiant's APT numbering system get replaced? Mandiant's APT-number scheme (APT1, APT41, etc.) was retired because Google merged it with its own Threat Analysis Group naming system to reduce confusion across teams. Shane Huntley, CTO of Google Threat Intelligence Group, said the original naming approach wasn't built to scale, since the industry now tracks more than 5,000 distinct activity clusters worldwide. _Anyone tracking threat actor naming changes across vendors can keep up via daily.dev._ ### Why don't all cybersecurity companies use the same names for hacking groups? Companies use different codenames because each has a distinct set of data and telemetry, giving them a slightly different view of the same group; no single vendor has perfect visibility. Shane Huntley of Google Threat Intelligence Group says this fragmentation can't be solved just by sharing more information, though resources like the MITRE ATT&CK groups list try to map overlapping names together. _Practitioners comparing threat actor naming schemes across vendors can track the debate on daily.dev._ ## Similar posts on daily.dev - [Google goes it alone with a new cybercrime crew taxonomy](https://daily.dev/posts/google-goes-it-alone-with-a-new-cybercrime-crew-taxonomy-dpt6piig4) · The Register · 0 upvotes · 0 comments - [Updated Cyber Threat Actor Naming System](https://daily.dev/posts/updated-cyber-threat-actor-naming-system-ede8ifwrj) · Google Cloud · 0 upvotes · 0 comments - [China-Nexus Actor Spied on US Researchers Undetected for a Year](https://daily.dev/posts/china-nexus-actor-spied-on-us-researchers-undetected-for-a-year-hvasfiprt) · Dark Reading · 0 upvotes · 0 comments - [From Log4j to IIS, China's Hackers Turn Legacy Bugs into Global Espionage Tools](https://daily.dev/posts/from-log4j-to-iis-china-s-hackers-turn-legacy-bugs-into-global-espionage-tools-woqwcbwos) · The Hacker News · 1 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#google](https://daily.dev/tags/google) [View this post on daily.dev](https://daily.dev/posts/google-s-top-hacker-hunter-explains-why-hacking-groups-get-codenames-tan0pphmp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google’s top hacker hunter explains why hacking groups get codenames","url":"https://daily.dev/posts/google-s-top-hacker-hunter-explains-why-hacking-groups-get-codenames-tan0pphmp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-s-top-hacker-hunter-explains-why-hacking-groups-get-codenames-tan0pphmp"},"datePublished":"2026-08-08T15:03:14.362Z","dateModified":"2026-09-14T08:44:13.292Z","description":"Google has revamped its naming system for hacking groups, replacing the old APT numbering scheme inherited from Mandiant with a new format: a memorable first...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1b9c778cb0035140e4372b133cb1804b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1b9c778cb0035140e4372b133cb1804b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-s-top-hacker-hunter-explains-why-hacking-groups-get-codenames-tan0pphmp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,google","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"Google’s top hacker hunter explains why hacking groups get codenames"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/google-s-top-hacker-hunter-explains-why-hacking-groups-get-codenames-tan0pphmp#faq","mainEntity":[{"@type":"Question","name":"What is Google's new naming system for hacking groups?","acceptedAnswer":{"@type":"Answer","text":"Google's new system gives each hacking group a memorable random first name paired with a second word whose initial letter indicates country of origin: Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia. This replaces the old APT-numbered scheme used by Mandiant and unifies it with the naming previously used by Google's Threat Analysis Group. Security teams adjusting to new threat actor naming conventions can follow the shift on daily.dev."}},{"@type":"Question","name":"Why did Mandiant's APT numbering system get replaced?","acceptedAnswer":{"@type":"Answer","text":"Mandiant's APT-number scheme (APT1, APT41, etc.) was retired because Google merged it with its own Threat Analysis Group naming system to reduce confusion across teams. Shane Huntley, CTO of Google Threat Intelligence Group, said the original naming approach wasn't built to scale, since the industry now tracks more than 5,000 distinct activity clusters worldwide. Anyone tracking threat actor naming changes across vendors can keep up via daily.dev."}},{"@type":"Question","name":"Why don't all cybersecurity companies use the same names for hacking groups?","acceptedAnswer":{"@type":"Answer","text":"Companies use different codenames because each has a distinct set of data and telemetry, giving them a slightly different view of the same group; no single vendor has perfect visibility. Shane Huntley of Google Threat Intelligence Group says this fragmentation can't be solved just by sharing more information, though resources like the MITRE ATT&CK groups list try to map overlapping names together. Practitioners comparing threat actor naming schemes across vendors can track the debate on daily.dev."}}]} ```