Threat reportThreat IntelligenceTL-2026-1730
Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy — Sandworm/APT44 Redesignated SANDWORM RELIC
Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy (TL-2026-1730), also tracked as GTIG Two-Word Cryptonym Naming Taxonomy, is a info-severity tracked intrusion set, first published 2026-07-27. It is attributed to Sandworm (Russia) with high confidence, affects Microsoft Windows / Office OLE Package Manager, references 1 CVE (CVE-2014-4114), maps to 33 MITRE ATT&CK techniques (T1003, T1005, T1014), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- INFOAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 33MITRE ATT&CK
- Actors
- 2Sandworm
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-1730
- Threat ID
- TL-2026-1730
- Also known as
- GTIG Two-Word Cryptonym Naming Taxonomy, Sandworm APT44 Rename to SANDWORM RELIC
- Severity
- INFO
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Sandworm, APT44
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- DESTRUCTION
- Target sectors
- government administration, critical infrastructure, energy, information technology, telecoms, defense, logistics, hosting providers, academic
- Target regions
- ukraine, Europe, united states of america, NATO member states, 151 - Eastern Europe
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy
Malware and tooling: BlackEnergy - S0089, CaddyWiper - S0693, Cyclops Blink, HermeticWiper - S0697, Industroyer2 - S1072, NotPetya, Olympic Destroyer - S0365, VPNFilter, Cobalt Strike, Exaramel, Mimikatz, P.A.S. webshell
How Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy works
Google Threat Intelligence Group (GTIG) has replaced its parallel Mandiant/TAG naming systems with a unified two-word cryptonym taxonomy — first word as unique identifier, second word encoding attribution/motivation (CASTLE=PRC, ION=Iran, NEPTUNE=North Korea, RELIC=Russia, COMET=cybercriminal). Sandworm/APT44, Russia's GRU Unit 74455 sabotage unit, is the only group confirmed renamed so far: SANDWORM RELIC.
Google Threat Intelligence Group (GTIG) announced on July 24, 2026 a unified, two-word cryptonym naming taxonomy for tracking cyber threat actors, replacing the parallel — and increasingly redundant — naming systems inherited separately from Mandiant (acquired 2022) and Google's in-house Threat Analysis Group (TAG). The first word of each cryptonym is a memorable, unique identifier (preferably carried over from prior public reporting, or randomly generated and bias-reviewed for newly discovered clusters); the second word encodes attribution or motivation: CASTLE for People's Republic of China-linked groups, ION for Iran-linked groups, NEPTUNE for North Korea-linked groups, RELIC for Russia-linked groups, and COMET for financially motivated cybercriminal groups. Groups whose attribution remains unresolved continue to be tracked under the legacy 'UNC' (uncategorized) designation. Google framed the change around the principle that 'threat tracking shouldn't be an exercise in memorization, but rather one of intuition,' and positioned it alongside — but distinct from — CrowdStrike's animal-based taxonomy (PANDA/BEAR/SPIDER/JACKAL) and Microsoft's April 2023 weather-based taxonomy (Typhoon/Blizzard/Sandstorm/Tempest), and a 2025 Microsoft-CrowdStrike alias-mapping initiative that translates between systems rather than standardizing on one.
GTIG has renamed several dozen of its most actively tracked groups in the initial rollout, with additional renamings continuing on a rolling basis; all legacy names remain indexed and searchable in the Google Threat Intelligence (GTI) platform alongside MITRE ATT&CK mappings and third-party vendor aliases, so existing detections, dossiers, and CTI feeds keyed to old names are not orphaned. The only renaming confirmed by name in initial reporting is Sandworm — long tracked by Mandiant as APT44 — which is now designated SANDWORM RELIC, reflecting its confirmed, high-confidence attribution to Russia's GRU (Main Intelligence Directorate) Main Center for Special Technologies (GTsST), military unit 74455.
This naming change is itself non-technical (no new exploit, campaign, or vulnerability is being reported), but it has direct operational relevance for defenders: any detection content, threat feed, dossier, or SOC runbook that references 'APT44,' 'Sandworm,' 'Voodoo Bear,' 'Telebots,' 'IRON VIKING,' 'ELECTRUM,' 'Quedagh,' 'Seashell Blizzard,' or 'FROZENBARENTS' now has an equivalent GTIG label of SANDWORM RELIC, and alias-mapping tables should be updated accordingly to avoid detection or correlation gaps. Sandworm/APT44/SANDWORM RELIC is one of the most consequential and longest-running Russian state threat actors in the public record: active since at least 2009, it is responsible for the 2014 'Sandworm Team' PowerPoint/OLE zero-day campaign (CVE-2014-4114) against NATO and Ukrainian/European government and energy targets; the December 2015 and December 2016 Ukrainian power-grid attacks (BlackEnergy, Industroyer); the June 2017 NotPetya global wiper outbreak disguised as ransomware; the February 2018 Olympic Destroyer attack on Pyeongchang Winter Olympics IT systems; the 2018 VPNFilter SOHO-router botnet (500,000+ infected devices); the 2017-2020 Centreon-based intrusion campaign against French IT/hosting providers documented by ANSSI; the wave of destructive wipers (WhisperGate, HermeticWiper, IsaacWiper) deployed against Ukraine in the run-up to the February 2022 invasion; and the April 2022 Industroyer2/CaddyWiper attack attempted (and disrupted before causing an outage) against a Ukrainian energy provider. This research record documents the naming-taxonomy change and consolidates the sourced, publicly documented TTPs, malware, and indicators tied to the renamed entity for cross-referencing and alias-mapping in the Threadlinqs platform.
MITRE ATT&CK techniques used in TL-2026-1730
Credential Access
T1003 OS Credential Dumping; T1110 Brute Force
Collection
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1218 System Binary Proxy Execution
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer
defense-impairment
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise; T1566 Phishing
Impact
T1485 Data Destruction; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1561 Disk Wipe
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy
- Microsoft — Windows / Office OLE Package Manager
Vulnerable versions: Windows Vista SP2 through Windows 8.1, Office 2007-2013 OLE handling (CVE-2014-4114)
Fixed in: Patched via MS14-060, October 14, 2014 - Centreon — Centreon IT Monitoring Software
Vulnerable versions: Internet-exposed Centreon servers on CentOS, 2017-2020 deployments
Fixed in: N/A - initial access vector undetermined per ANSSI - Multiple SOHO vendors — Linksys, MikroTik, Netgear, TP-Link, QNAP network devices
Vulnerable versions: Firmware versions vulnerable to VPNFilter (2018) and Cyclops Blink (2022) infection
Fixed in: Vendor-specific firmware updates plus factory reset per FBI/CISA guidance - Industrial control systems — IEC 60870-5-104 substation protocol devices / MicroSCADA
Vulnerable versions: Ukrainian electric transmission substation infrastructure (April 2022 Industroyer2 incident)
Fixed in: N/A - protocol-level and operational segmentation mitigations
Remediation for Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy
Patches
- Ensure MS14-060 (CVE-2014-4114) and all subsequent Windows/Office cumulative updates are applied
- Apply vendor firmware updates for SOHO/edge devices historically targeted by VPNFilter and Cyclops Blink
Immediate actions
- Update threat-intel platforms and detection-rule actor-attribution fields to map SANDWORM RELIC alongside legacy APT44/Sandworm/Voodoo Bear/Telebots aliases so existing detections and dossiers remain searchable
- Hunt for known Sandworm wiper/backdoor indicators (NotPetya, CaddyWiper, Industroyer2, Exaramel, P.A.S. webshell hashes/IOCs) across Windows and ICS/OT environments
- Verify SOHO/edge network devices are patched and rebooted to clear VPNFilter/Cyclops Blink-style persistence
Workarounds
- Restrict and monitor outbound access from ICS/SCADA networks
- Disable or tightly control OLE package-manager execution of remote resources where legacy systems cannot be patched
Longer-term hardening
- Segment ICS/OT networks from corporate IT and monitor IEC 60870-5-104 and similar substation protocols for anomalous commands
- Establish a cross-vendor alias-mapping process (GTIG, MITRE ATT&CK, CrowdStrike, Microsoft naming) in the threat-intel program so actor rebrands don't create detection or reporting gaps
- Maintain hardened, monitored ingress on internet-facing monitoring/management software (e.g., Centreon-class tools)
CVEs associated with Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy
Weaknesses (CWE) in Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy
Timeline of Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy
- Microsoft patches CVE-2014-4114 (MS14-060) after iSIGHT Partners identifies the 'Sandworm Team' and its PowerPoint/OLE zero-day campaign against NATO, Ukrainian government, and European energy and telecom targets.
- A Sandworm-attributed, BlackEnergy-enabled intrusion cuts power to roughly 230,000 Ukrainian consumers — the first confirmed cyberattack-caused blackout.
- Industroyer malware is used in a second Ukrainian grid attack, targeting a Kyiv transmission substation and directly manipulating ICS protocols.
- NotPetya, a destructive wiper disguised as ransomware, spreads globally via a compromised M.E.Doc tax-software updater, causing billions of dollars in damage.
- Olympic Destroyer malware disrupts IT systems at the Pyeongchang Winter Olympics opening ceremony.
- Cisco Talos discloses VPNFilter, a multi-stage modular malware infecting at least 500,000 SOHO routers and NAS devices, with code overlaps tied to Sandworm/BlackEnergy.
- France's ANSSI attributes a three-year (2017-2020) intrusion campaign against French hosting and IT providers, via compromised Centreon monitoring servers, to Sandworm.
- A wave of destructive wiper malware (WhisperGate, HermeticWiper, IsaacWiper) is deployed against Ukrainian government and commercial organizations ahead of the Russian invasion.
- Sandworm deploys Industroyer2 and CaddyWiper in an attempted attack on a Ukrainian energy provider; the attack is detected and disrupted before causing an outage.
- Mandiant/Google Cloud publish 'Unearthing APT44,' formally consolidating Sandworm's tracked activity under the APT44 designation.
- GTIG publishes its updated two-word cryptonym threat-actor naming taxonomy on the Google Cloud blog, replacing the separate Mandiant/TAG naming systems.
- Sandworm/APT44 is formally redesignated SANDWORM RELIC under the new GTIG taxonomy; reported by Help Net Security and other outlets.
Sources cited for Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy
- Google changes how it names cyber threat actors
- Updated Cyber Threat Actor Naming System
- Google's solution to hacker name confusion? Yet another naming system
- Google rolls out new naming system for cyber threat actors
- Google Is Giving Hacker Groups New Names That Reveal Who They Are and Why They Attack
- Google Launches Unified Cryptonym-Based Naming System for Threat Actors
- Insane Castle Hurricane: APT Codename Confusion Proliferates
- Google introduces standardized nomenclature for Cyber Threat Groups
- Sandworm Team, ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh, Voodoo Bear, IRIDIUM, Seashell Blizzard, FROZENBARENTS, APT44 (G0034)
- Unearthing APT44: Russia's Notorious Cyber Sabotage Unit Sandworm
- Update: Destructive Malware Targeting Organizations in Ukraine (AA22-057A)
- MAR-10376640-2.v1 – CaddyWiper
- New VPNFilter malware targets at least 500K networking devices worldwide
- Sandworm (Threat Actor)
- Sandworm Hackers Hit French Monitoring Software Vendor Centreon
Detection coverage for TL-2026-1730
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1730 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.