# Google GTIG Adopts Two-Word Threat Actor Naming Taxonomy — Sandworm/APT44 Redesignated SANDWORM RELIC

> Google Threat Intelligence Group (GTIG) has replaced its parallel Mandiant/TAG naming systems with a unified two-word cryptonym taxonomy — first word as unique identifier, second word encoding attribution/motivation (CASTLE=PRC, ION=Iran, NEPTUNE=North Korea, RELIC=Russia, COMET=cybercriminal). Sandworm/APT44, Russia's GRU Unit 74455 sabotage unit, is the only group confirmed renamed so far: SANDWORM RELIC.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1730
- **ID:** TL-2026-1730
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Sandworm (Russia)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2014-4114

## Description

Google Threat Intelligence Group (GTIG) announced on July 24, 2026 a unified, two-word cryptonym naming taxonomy for tracking cyber threat actors, replacing the parallel — and increasingly redundant — naming systems inherited separately from Mandiant (acquired 2022) and Google's in-house Threat Analysis Group (TAG). The first word of each cryptonym is a memorable, unique identifier (preferably carried over from prior public reporting, or randomly generated and bias-reviewed for newly discovered clusters); the second word encodes attribution or motivation: CASTLE for People's Republic of China-linked groups, ION for Iran-linked groups, NEPTUNE for North Korea-linked groups, RELIC for Russia-linked groups, and COMET for financially motivated cybercriminal groups. Groups whose attribution remains unresolved continue to be tracked under the legacy 'UNC' (uncategorized) designation. Google framed the change around the principle that 'threat tracking shouldn't be an exercise in memorization, but rather one of intuition,' and positioned it alongside — but distinct from — CrowdStrike's animal-based taxonomy (PANDA/BEAR/SPIDER/JACKAL) and Microsoft's April 2023 weather-based taxonomy (Typhoon/Blizzard/Sandstorm/Tempest), and a 2025 Microsoft-CrowdStrike alias-mapping initiative that translates between systems rather than standardizing on one.

GTIG has renamed several dozen of its most actively tracked groups in the initial rollout, with additional renamings continuing on a rolling basis; all legacy names remain indexed and searchable in the Google Threat Intelligence (GTI) platform alongside MITRE ATT&CK mappings and third-party vendor aliases, so existing detections, dossiers, and CTI feeds keyed to old names are not orphaned. The only renaming confirmed by name in initial reporting is Sandworm — long tracked by Mandiant as APT44 — which is now designated SANDWORM RELIC, reflecting its confirmed, high-confidence attribution to Russia's GRU (Main Intelligence Directorate) Main Center for Special Technologies (GTsST), military unit 74455.

This naming change is itself non-technical (no new exploit, campaign, or vulnerability is being reported), but it has direct operational relevance for defenders: any detection content, threat feed, dossier, or SOC runbook that references 'APT44,' 'Sandworm,' 'Voodoo Bear,' 'Telebots,' 'IRON VIKING,' 'ELECTRUM,' 'Quedagh,' 'Seashell Blizzard,' or 'FROZENBARENTS' now has an equivalent GTIG label of SANDWORM RELIC, and alias-mapping tables should be updated accordingly to avoid detection or correlation gaps. Sandworm/APT44/SANDWORM RELIC is one of the most consequential and longest-running Russian state threat actors in the public record: active since at least 2009, it is responsible for the 2014 'Sandworm Team' PowerPoint/OLE zero-day campaign (CVE-2014-4114) against NATO and Ukrainian/European government and energy targets; the December 2015 and December 2016 Ukrainian power-grid attacks (BlackEnergy, Industroyer); the June 2017 NotPetya global wiper outbreak disguised as ransomware; the February 2018 Olympic Destroyer attack on Pyeongchang Winter Olympics IT systems; the 2018 VPNFilter SOHO-router botnet (500,000+ infected devices); the 2017-2020 Centreon-based intrusion campaign against French IT/hosting providers documented by ANSSI; the wave of destructive wipers (WhisperGate, HermeticWiper, IsaacWiper) deployed against Ukraine in the run-up to the February 2022 invasion; and the April 2022 Industroyer2/CaddyWiper attack attempted (and disrupted before causing an outage) against a Ukrainian energy provider. This research record documents the naming-taxonomy change and consolidates the sourced, publicly documented TTPs, malware, and indicators tied to the renamed entity for cross-referencing and alias-mapping in the Threadlinqs platform.

## MITRE ATT&CK

- T1595 Active Scanning
- T1594 Search Victim-Owned Websites
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1133 External Remote Services
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1014 Rootkit
- T1218 System Binary Proxy Execution
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction
- T1561 Disk Wipe
- T1490 Inhibit System Recovery
- T1529 System Shutdown/Reboot

## Sources

- [Google changes how it names cyber threat actors](https://www.helpnetsecurity.com/2026/07/27/google-threat-actors-naming-system/)
- [Updated Cyber Threat Actor Naming System](https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system)
- [Google's solution to hacker name confusion? Yet another naming system](https://cyberscoop.com/google-threat-actor-naming-system/)
- [Google rolls out new naming system for cyber threat actors](https://securitybrief.com.au/story/google-rolls-out-new-naming-system-for-cyber-threat-actors)
- [Google Is Giving Hacker Groups New Names That Reveal Who They Are and Why They Attack](https://cybersecuritynews.com/google-is-giving-hacker-groups-new-names/)
- [Google Launches Unified Cryptonym-Based Naming System for Threat Actors](https://gbhackers.com/google-launches-unified-cryptonym-based-naming-system/)
- [Insane Castle Hurricane: APT Codename Confusion Proliferates](https://www.govinfosecurity.com/blogs/insane-castle-hurricane-apt-codename-confusion-proliferates-p-4162)
- [Google introduces standardized nomenclature for Cyber Threat Groups](https://www.cybersecurity-insiders.com/google-introduces-standardized-nomenclature-for-cyber-threat-groups/)
- [Sandworm Team, ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh, Voodoo Bear, IRIDIUM, Seashell Blizzard, FROZENBARENTS, APT44 (G0034)](https://attack.mitre.org/groups/G0034/)
- [Unearthing APT44: Russia's Notorious Cyber Sabotage Unit Sandworm](https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm)
- [Update: Destructive Malware Targeting Organizations in Ukraine (AA22-057A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-057a)
- [MAR-10376640-2.v1 – CaddyWiper](https://www.cisa.gov/news-events/analysis-reports/ar22-115c)
- [New VPNFilter malware targets at least 500K networking devices worldwide](https://blog.talosintelligence.com/vpnfilter/)
- [Sandworm (Threat Actor)](https://malpedia.caad.fkie.fraunhofer.de/actor/sandworm)
- [Sandworm Hackers Hit French Monitoring Software Vendor Centreon](https://www.securityweek.com/sandworm-hackers-hit-french-monitoring-software-vendor-centreon/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1730