# Google creates new taxonomy for cybercrime groups Breaking away from Microsoft-led naming initiative, Google announces its own system. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-27 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/965edc30-01cc-43c1-9a7d-fe18b5487cc8 ## Google's new taxonomy system Google has announced a new taxonomy system to classify cybercrime groups. This system was developed following the integration of security firm Mandiant, acquired in 2022, into the Google Threat Intelligence Group (CTIG). The two-word schema uses the first word as a unique and memorable term representing the threat actor. If the security community has already established a name, Google will use it; otherwise, it will generate a random word to eliminate bias. The second word categorizes the threat cluster by motivation, attribution, or activity type. ## Country-specific naming conventions Google's new system assigns specific codenames to countries. Threats originating from China will be labeled 'CASTLE', Iran as 'ION', North Korea as 'NEPTUNE', Russia as 'RELIC', and non-state-sponsored cybercriminals as 'COMET'. This naming convention is structured around categories critical for defense and response strategies. Google noted that other security companies have developed similar schemas but aims to keep its system as simple as possible to streamline operations. ## Departure from Microsoft's collaborative effort Google's move signals its departure from the industry-wide consistent naming initiative led by Microsoft and CrowdStrike in 2025. At that time, Google and Mandiant were reportedly keen to adopt Microsoft's scheme. However, the new announcement suggests this collaboration has ended. Multiple naming schemas in the industry lead to confusion, with researchers referring to the same group by different names. For instance, Russia's Military Intelligence Unit 74455 is known by over 10 names including Seashell Blizzard, IRIDIUM, and VOODOO BEAR. ## China's objections to naming practices In 2024, China's National Computer Virus Emergency Response Center (CVERC) objected to Western companies using names like 'Typhoon', 'Panda', or 'Dragon' for Chinese cybercrime groups. CVERC suggested names reflecting English idioms, such as 'Hurricane' or 'Koala', would be more appropriate. 'Koala' originates from the language of the Darug people, indigenous to the Sydney area before British colonization. These marsupials, known for sleeping 18-22 hours daily, represent passive creatures. Google's choice of 'CASTLE' for China aims to reduce such cultural biases. ## Industry confusion The cybersecurity industry's fragmentation due to different naming systems creates significant confusion. Organizations typically use multiple security tools, making it challenging to interpret threat intelligence from various vendors. The same group being referred to by ten different names complicates defense strategy coordination. Microsoft and CrowdStrike's 2025 initiative aimed to solve this problem, but Google's new system may deepen the industry's division. ## Impact of Mandiant integration Google's $5.4 billion acquisition of Mandiant in 2022 significantly boosted its cybersecurity capabilities. Mandiant, one of the world's leading threat intelligence firms, was integrated into CTIG. The new taxonomy system is a tangible outcome of this merger. However, Google's decision not to join Microsoft's industry-wide standardization effort signals its intent to pursue a more independent path in this domain. ## Implications for defense strategies Google's new taxonomy system could significantly impact cyber defense strategies. Consistent naming facilitates tracking and analyzing threat actors' activities. However, the existence of different systems across the industry may hinder information sharing. Google claims its system's simplicity and ease of mapping to other schemas could mitigate this issue. On the other hand, this competition among tech giants might undermine standardization efforts in cybersecurity. ## A new era in cybersecurity Google's move may mark the beginning of a new era in cybersecurity. While competition among major tech companies in threat intelligence could disrupt standardization efforts, it might also drive innovation. With Mandiant's expertise strengthening its position, Google clearly aims to become more influential in this field. However, whether industry-wide efforts to establish a common language will continue remains critical for the future of cybersecurity. ## Sources covering this story - https://www.theregister.com/security/2026/07/27/google-goes-it-alone-with-a-new-cybercrime-crew-taxonomy/5278749 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._