Google Gives Hackers New Names, Here Is Why That Matters
Google's threat-intelligence team is replacing number codes with memorable two-word labels for every hacking group it tracks, making it easier for researchers and companies to talk about the same criminals.
Key points
- Google's threat-intelligence unit is switching from number codes like "APT44" to plain two-word names for every hacking group it follows.
- The second word signals where a group comes from or what drives it: "Relic" for Russia, "Castle" for China, "Ion" for Iran, "Neptune" for North Korea, "Comet" for criminal gangs.
- Russia's Sandworm, blamed for attacks on power grids and election infrastructure, becomes "Sandworm Relic" under the new system.
- Old names stay searchable inside Google's threat platform, so researchers who know a group by its previous label won't lose their place.
- The change covers dozens of the most active groups now, with the rest to follow on a rolling basis.
If you follow cybersecurity news, you've probably noticed that the same hacking group can carry five different names depending on which company wrote the report. Microsoft calls one Russian crew "Seashell Blizzard." Other researchers call that same crew "Sandworm," "Voodoo Bear," or "TeleBots." Google tracked them as "APT44," where APT stands for Advanced Persistent Threat, the industry's shorthand for well-funded, government-linked hacking teams.
That alphabet soup slows down defenders trying to work out whether a fresh attack belongs to a group they already know.
Google's answer is a naming system built on two-word pairs. A memorable first word identifies the specific group. The second word works as a category tag.
What do the new category words mean?
Each second word maps to an origin country or a motivation, acting as a surname that tells you where the group is from.
| Second word | What it signals |
|---|---|
| Relic | Russia |
| Castle | China |
| Ion | Iran |
| Neptune | North Korea |
| Comet | Criminal (financially motivated) gangs |
Groups that haven't been firmly attributed to any country keep the "UNC" label, short for uncategorized, which Google has used for years.
Sandworm is the headline example. The Russian military crew is held responsible for knocking out parts of Ukraine's electricity grid and for the destructive NotPetya malware attack in 2017. Google tracked them as APT44; they're now Sandworm Relic. At least thirteen other names for the same crew float around the industry, according to SecurityWeek. That's exactly the problem Google is trying to fix. Our July reporting on Sandworm sub-group activity against Ukrainian targets showed how tangled attribution gets when different teams use different labels for the same actor.
Does this change anything for ordinary people?
Not directly. Renaming a hacking group doesn't make them less dangerous. What it does is help security teams at hospitals and banks share information quickly and accurately, which is a practical gain defenders have needed for a long time.
When a security analyst reads an alert, the group's name now carries a built-in clue about who is behind the attack and roughly what they want. That's a small thing on paper. In a fast-moving incident it can save hours.
If you're a customer of a company targeted by one of these groups, the advice is unchanged: watch for unexpected emails asking for passwords, enable two-step verification on important accounts, and report anything suspicious to your IT team or bank.
The honest read here is that this is a housekeeping move, not a security breakthrough. What to watch is whether competitors adopt compatible second-word categories or fragment the taxonomy further.
