Marquee feature
The naming crosswalk
APT29 is Cozy Bear is Midnight Blizzard is IRON RITUAL is UNC2452 is The Dukes. Every vendor names adversaries differently, and a report that uses an unfamiliar taxonomy costs an analyst ten minutes of cross-referencing before they can even start reading. This is 357 designators across 15 organisations, in one table.
Why the names differ
Each vendor clusters activity from its own telemetry, then names the cluster. Microsoft encodes origin in a weather system, CrowdStrike in an animal, Secureworks in a metal, Mandiant in a number. The convention tells you the attributed sponsor before you read a word of the report.
Why partial matters
Cluster boundaries rarely align exactly. A designator marked ~ overlaps this group but is not synonymous with it — treating it as an equivalence is the most common way analysts import someone else's attribution error.
Built for export
Copy the filtered view as TSV or CSV and paste straight into a brief, a spreadsheet, or a detection ticket. The first column stays pinned while you scroll across taxonomies.
35 groups × 8 taxonomies
| Group | MITRE | Microsoft | CrowdStrike | Mandiant | Secureworks | Unit 42 | Recorded Future | Red Canary |
|---|---|---|---|---|---|---|---|---|
| Ghostwriter🇧🇾 Belarus | UNC1151 | Storm-0257 | Ghostwriter | UNC1151Ghostwriter~ | — | — | TA445 | — |
| APT1🇨🇳 China · Unit 61398 | APT1 | — | Comment Panda | APT1 | TG-8223 | — | Byzantine Candor | — |
| APT10🇨🇳 China · Huaying Haitai Science and Technology Development Co. (front company) | menuPass | — | Stone Panda | APT10 | BRONZE RIVERSIDE | — | RedApollo | — |
| APT31🇨🇳 China · Wuhan Xiaoruizhi Science and Technology Company (front company) | APT31 | Violet Typhoon | Judgment Panda | APT31 | BRONZE VINEWOOD | — | RedBravo | — |
| APT40🇨🇳 China · Hainan Xiandun Technology Development Co. (front company) | APT40 | Gingham Typhoon | Kryptonite Panda | APT40TEMP.PeriscopeTEMP.Jumper | BRONZE MOHAWK | — | ISLANDDREAMS | — |
| APT41🇨🇳 China | APT41 | Brass Typhoon | Wicked Panda | APT41Double Dragon | BRONZE ATLAS | — | — | — |
| Mustang Panda🇨🇳 China | Mustang Panda | Twill Typhoon | Mustang Panda | Camaro Dragon~ | BRONZE PRESIDENT | Stately Taurus | RedDelta | — |
| Salt Typhoon🇨🇳 China | — | Salt Typhoon | OPERATOR PANDA | UNC5807 | BRONZE ESSAY~ | — | RedMike | — |
| Silk Typhoon🇨🇳 China | — | Silk Typhoon | MURKY PANDA | UNC5221~ | BRONZE SILHOUETTE~ | — | — | — |
| Volt Typhoon🇨🇳 China | Volt Typhoon | Volt Typhoon | VANGUARD PANDA | UNC3236 | BRONZE SILHOUETTE | Insidious Taurus | — | Volt Typhoon |
| SideWinder🇮🇳 India | SideWinder | Storm-0343~ | Razor Tiger | — | TIN BAROMETER | — | APT-C-17 | — |
| APT33🇮🇷 Iran | APT33 | Peach Sandstorm | Refined Kitten | APT33 | COBALT TRINITY | Curious Serpens | — | — |
| APT34🇮🇷 Iran | OilRig | Hazel Sandstorm | Helix Kitten | APT34 | COBALT GYPSY | Evasive Serpens | — | — |
| APT35🇮🇷 Iran · IRGC-affiliated contractors, including Emennet Pasargad and Mahak Rayan Afraz | Magic Hound | Mint Sandstorm | Charming Kitten | APT35 | COBALT ILLUSION | Charming Serpens | ITG18~ | — |
| CyberAv3ngers🇮🇷 Iran · IRGC-CEC | — | CyberAv3ngers | CyberAv3ngers | CyberAv3ngers | — | CyberAv3ngers | — | — |
| MuddyWater🇮🇷 Iran | MuddyWater | Mango Sandstorm | Static Kitten | TEMP.Zagros | COBALT ULSTER | Boggy Serpens | — | — |
| Predatory Sparrow🇮🇱 Israel | — | Predatory Sparrow | Predatory Sparrow | Predatory Sparrow | — | — | — | — |
| Cl0p🏴 Multiple / Non-state | — | Lace Tempest | Graceful Spider | FIN11~ | GOLD TAHOE | Baleful Scorpius | Cl0p | — |
| FIN7🏴 Multiple / Non-state | FIN7 | Sangria Tempest | Carbon Spider | FIN7 | GOLD NIAGARA | Carbon Spider | — | FIN7 |
| LockBit🏴 Multiple / Non-state | — | Storm-0506~ | Bitwise Spider | UNC2165~ | GOLD MYSTIC | Ambitious Scorpius | LockBit | — |
| Scattered Spider🏴 Multiple / Non-state | Scattered Spider | Octo Tempest | Scattered Spider | UNC3944 | GOLD HARVESTER | Muddled Libra | Scattered Spider | Scattered Spider |
| Andariel🇰🇵 North Korea · 3rd Bureau (Andariel / Onyx Sleet) | Andariel | Onyx Sleet | Silent Chollima | APT45 | NICKEL HYATT | Jumpy Pisces | — | — |
| APT37🇰🇵 North Korea | APT37 | Ruby Sleet | Ricochet Chollima | APT37Reaper | NICKEL FOXCROFT | Velvet Chollima~ | — | — |
| APT38🇰🇵 North Korea · Bluenoroff / financial operations element | APT38 | Sapphire Sleet | Stardust Chollima | APT38 | NICKEL GLADSTONE | Sparkling Pisces~ | — | — |
| Kimsuky🇰🇵 North Korea · Assessed within the RGB structure | Kimsuky | Emerald Sleet | Velvet Chollima | APT43 | NICKEL KIMBALL | Sparkling Pisces | TAG-71 | — |
| Lazarus Group🇰🇵 North Korea · Lab 110 / 3rd Bureau | Lazarus Group | Diamond Sleet | Labyrinth Chollima | APT38~TEMP.Hermit | NICKEL ACADEMY | Slow Pisces~ | TAG-71~ | — |
| APT36🇵🇰 Pakistan | Transparent Tribe | Storm-0156~ | Mythic Leopard | — | ALUMINUM SARATOGA | — | — | — |
| APT28🇷🇺 Russia · Unit 26165 | APT28 | Forest Blizzard | Fancy Bear | APT28 | IRON TWILIGHTTG-4127 | Fighting Ursa | BlueDelta | — |
| APT29🇷🇺 Russia | APT29 | Midnight Blizzard | Cozy Bear | APT29UNC2452~ | IRON RITUALIRON HEMLOCK~ | Cloaked Ursa | BlueBravo | Cozy Bear |
| Berserk Bear🇷🇺 Russia · Centre 16 | Dragonfly | Ghost Blizzard | Berserk BearEnergetic Bear~ | TEMP.Isotope | IRON LIBERTY | — | — | — |
| Gamaredon🇷🇺 Russia · 18th Centre / Crimean directorate | Gamaredon Group | Aqua Blizzard | Primitive Bear | UNC530 | IRON TILDEN | Trident Ursa | BlueAlpha | — |
| Sandworm🇷🇺 Russia · Unit 74455 | Sandworm Team | Seashell Blizzard | Voodoo Bear | APT44FROZENBARENTS | IRON VIKING | — | UAC-0002 | — |
| Star Blizzard🇷🇺 Russia · Centre 18 | Star Blizzard | Star Blizzard | Gossamer Bear | UNC4057COLDRIVER | — | — | BlueCharlieTAG-53 | — |
| Turla🇷🇺 Russia · Centre 16 | Turla | Secret Blizzard | Venomous Bear | Turla | IRON HUNTER | Pensive Ursa | Group 88 | — |
| APT32🇻🇳 Vietnam | APT32 | Canvas Cyclone | Ocean Buffalo | APT32 | TIN WOODLAWN | Sea Lotus | — | — |
Naming conventions, decoded
Most taxonomies encode the attributed sponsor in the name itself. Learn these and you can read an unfamiliar designator cold.
MITRE ATT&CK
index ↗Assigns a stable Gxxxx group ID and adopts the most widely used public name. Deliberately conservative — MITRE merges clusters only when public reporting supports it.
Microsoft Threat Intelligence
index ↗Weather-event family encodes the attributed origin; the adjective is arbitrary. Renamed from the older element taxonomy (STRONTIUM, NOBELIUM, HAFNIUM) in April 2023. 'Storm-####' is a temporary designator for a cluster still in development.
- Blizzard
- Russia
- Typhoon
- China
- Sandstorm
- Iran
- Sleet
- North Korea
- Rain
- South Korea
- Cyclone
- Vietnam
- Dust
- Turkey
- Tempest
- Financially motivated
- Tsunami
- Private-sector offensive actor
- Flood
- Influence operations
- Storm-####
- Cluster in development
CrowdStrike
index ↗Animal denotes attributed nation-state or motive; the adjective distinguishes clusters. The original public adversary taxonomy, in use since 2012.
- Bear
- Russia
- Panda
- China
- Kitten
- Iran
- Chollima
- North Korea
- Spider
- eCrime / financially motivated
- Tiger
- India
- Leopard
- Pakistan
- Buffalo
- Vietnam
- Crane
- South Korea
- Wolf
- Turkey
- Jackal
- Hacktivist
- Ocelot
- Colombia
Mandiant / Google Threat Intelligence
index ↗APTxx for state-nexus espionage, FINxx for financially motivated, UNCxxxx ('uncategorized') for clusters not yet graduated to a named group. Many UNC numbers are later merged into an APT/FIN designator.
- APTxx
- State-nexus espionage
- FINxx
- Financially motivated
- UNCxxxx
- Uncategorized cluster
- TEMP.xxx
- Temporary designator
Secureworks CTU
index ↗Metal prefix encodes attributed origin, paired with an arbitrary uppercase codeword.
- IRON
- Russia
- BRONZE
- China
- COBALT
- Iran
- NICKEL
- North Korea
- GOLD
- Financially motivated
- TIN
- India
- ALUMINUM
- Pakistan
Palo Alto Networks Unit 42
index ↗Constellation denotes attributed origin or motive, adopted in 2023 to replace ad-hoc naming.
- Ursa
- Russia
- Taurus
- China
- Serpens
- Iran
- Pisces
- North Korea
- Libra
- eCrime
- Scorpius
- Ransomware
- Draco
- Hacktivist
Recorded Future Insikt Group
index ↗Colour prefix encodes attributed origin (RedXxxx = China, BlueXxxx = Russia). TAG-## ('Threat Activity Group') is a provisional designator for clusters pending attribution.
- RedXxxx
- China
- BlueXxxx
- Russia
- TAG-##
- Unattributed activity group
Red Canary
index ↗Names activity clusters descriptively rather than by a fixed nation-state taxonomy, and generally adopts the prevailing community name for established state actors. Coverage skews toward commodity and eCrime threats seen in managed-detection telemetry.
ESET Research
index ↗Descriptive names, frequently derived from the group's flagship malware family.
Kaspersky GReAT
index ↗Descriptive names, often coined from a distinctive string or artifact in the toolset.
Trend Micro
index ↗'Earth <name>' for many state-nexus groups; older clusters retain descriptive names such as Pawn Storm.
- Earth xxx
- State-nexus cluster
- Water xxx
- eCrime cluster
- Void xxx
- Unattributed cluster
Dragos
index ↗Mineral names for groups with demonstrated or assessed intent against industrial control systems. A Dragos designator is a meaningful signal: it means OT/ICS capability, not just IT intrusion.
Proofpoint
index ↗TA### ('Threat Actor'), numbered sequentially in order of first tracking.
Symantec (Broadcom)
index ↗Insect, animal, and plant names assigned in the order clusters were first identified.
CISA / NSA / FBI
index ↗U.S. government advisories generally reference groups by the most common industry name plus the attributed unit. Joint advisories are the authoritative source for unit-level attribution.