A Threat-Actor Name Is Not a Stable Adversary

“We track the named groups that target our sector, so we know who we are defending against.”

Hold on.

You track names.

That is a different thing.

A threat-actor name is a vendor’s cluster, not a stable adversary.

No standards body assigns threat-actor names.

Nobody.

Each vendor runs its own scheme, built on its own visibility and its own confidence process.

One vendor sees network infrastructure.

Another sees malware samples.

A third sees artefacts from incident-response engagements.

Each reaches its naming threshold at a different time, on different anchoring evidence, before anyone notices the clusters are the same people.

So one group ends up with a name from every vendor that has independently tracked it.

Take APT29, ATT&CK Group G0016.

Cozy Bear and CozyDuke at CrowdStrike.

NOBELIUM, then Midnight Blizzard, at Microsoft.

The Dukes, its earliest public name, from F-Secure.

IRON RITUAL and IRON HEMLOCK at Secureworks.

Dark Halo and UNC2452 for the SolarWinds cluster, until Mandiant folded UNC2452 into APT29.

Count them: ten names, APT29 included.

Your threat model has a row that says “APT29.”

Which of those ten did the analyst who wrote it actually read about?

1. “But the Vendor Report Names the Group With High Confidence.”

It names its group with high confidence.

That is a statement about one vendor’s telemetry reaching one vendor’s threshold.

The schemes are not four views of one taxonomy.

They do different jobs.

Mandiant grades maturity. APT and FIN are reserved for groups with an established, publicly documented pattern of activity, a numbering that began with the February 2013 APT1 report.

Below that sits UNC: a cluster of infrastructure, tooling and tradecraft that analysts have linked but are not yet ready to classify.

TEMP marks a cluster clearly evolving toward a specific group.

UNC clusters grow, merge, or graduate. Mandiant’s own example is UNC902 becoming FIN11.

CrowdStrike encodes origin or motive in an adjective-plus-animal cryptonym. BEAR for Russia, PANDA for China, KITTEN for Iran, CHOLLIMA for North Korea, SPIDER for financially motivated eCrime, JACKAL for hacktivists.

Microsoft gives newly discovered activity a temporary Storm-#### label until it can assign a permanent family and adjective.

Functionally, its UNC.

Now read your report again.

If the group is a UNC or a Storm-####, the vendor has told you, in the name itself, that the cluster is provisional.

If it is named, the vendor has told you it reached a stable designation inside that vendor’s view.

Neither tells you the boundary is settled across vendors.

The UNC2452 merge was retrospective work.

It was not a correction available to anyone on the day either name was assigned.

Confidence in a cluster is not confidence in a boundary.

2. “But MITRE ATT&CK Lists the Group, So the Name Is Authoritative.”

ATT&CK does not originate attribution.

At all.

Its Group pages aggregate other vendors’ public reporting into one entry, under a G#### ID, and list every known alias against it.

That is enormously useful.

It is an index.

Scattered Spider is G1015. The entry lists Roasted 0ktapus, Octo Tempest, Storm-0875 and UNC3944 under one name.

Unit 42 calls the same activity Muddled Libra.

Earlier reporting called it Scatter Swine.

Mandiant still cites UNC3944 alongside Scattered Spider, rather than retiring it. That is normal, not an error.

FIN7 is G0046.

Carbon Spider at CrowdStrike, GOLD NIAGARA at Secureworks, ITG14 at IBM X-Force, Sangria Tempest at Microsoft.

And ELBRUS, Mandiant’s own internal name, used before or alongside its public FIN7 label.

One vendor, two names, same activity.

The G#### ID is the one identifier meant to survive any single vendor’s renaming.

Use it.

But do not read the alias list as a guarantee that every name under one ID describes identical activity with total confidence.

Some entries are a vendor’s own retrospective merge, tracked as separate for a period.

Some names are not even one group.

Lazarus Group, G0032, is an umbrella. By MITRE’s own documentation it covers multiple North Korean operators who share personnel, infrastructure and malware while pursuing distinct missions: destructive sabotage, espionage, cryptocurrency theft.

The cluster that runs a crypto heist and the cluster that runs a wiper may share a parent without sharing a plan.

The name chain is no tidier.

HIDDEN COBRA is the US government’s own designation, used in CISA and FBI advisories.

Guardians of Peace is what the group called itself in its 2014 Sony Pictures messaging.

Labyrinth Chollima at CrowdStrike. ZINC, then Diamond Sleet, at Microsoft.

A government running its own scheme in parallel with the vendors.

One more independent namer, for one umbrella.

“Lazarus did X” is often a claim about an administrative convenience.

An alias index is not an adversary.

3. “But the Indicator Matched That Group’s Known Malware Exactly.”

Exactly is the problem.

Olympic Destroyer disrupted the opening ceremony of the 2018 Pyeongchang Winter Olympics.

Within days, independent research teams had attributed it to North Korea, to Russia, and to China.

Each cited genuine-looking technical overlap.

The North Korea case rested on a build fingerprint, a specific combination of compiler and build-environment artefacts.

It showed a 100% match with previously known Lazarus malware components.

And zero overlap with any other clean or malicious file.

Kaspersky then verified each feature by hand, and found the set had been assembled to match Lazarus.

Forged.

Vitaly Kamluk’s description: “a criminal had stolen someone else’s DNA and left it at a crime scene instead of their own.”

What survived the forgery was duller evidence. Infrastructure choices, including NordVPN and a hosting provider that accepted Bitcoin. Tradecraft patterns.

Those pointed toward Sofacy/Sandworm, of assessed Russian origin.

In October 2020, the US Department of Justice indicted five Russian GRU officers for the operation.

More than two years after the attack.

And even after exposing the forgery, Kaspersky called precise attribution “still an open question.”

Now picture the control decision made in week one.

Rules tuned for one country’s toolset.

A board briefing naming the wrong state.

A threat model that re-scoped itself around a planted fingerprint.

The indicator that looked most conclusive was the one somebody manufactured.

A well-resourced actor can produce precisely the match you are looking for.

That is what makes it a good forgery.

4. “But That Group Shut Down Last Year.”

Its brand shut down.

Conti retired its leak site, negotiation portal and chat infrastructure on 19 May 2022.

An internal chat leak, triggered by the group’s public support for Russia’s invasion of Ukraine, had made the name toxic to victims and affiliates alike.

Researchers at the time were explicit.

A brand retirement.

Not a personnel retirement.

Members of the same organisation reappeared as Black Basta, running conventional encryption and extortion.

As Karakurt, running data-theft extortion with no encryption at all.

As BlackByte, on an affiliate model.

Is Black Basta a new group, or Conti under different letterhead?

Both descriptions are defensible.

Treating them as unrelated is wrong.

Treating them as identical is equally wrong.

The personnel and tradecraft persisted.

The organisational and brand boundary did not.

Your threat model had a Conti row.

Somebody marked it closed in June 2022.

Nothing about the capability it described had closed.

Worse, one successor changed business model entirely. Karakurt’s extortion without encryption would never have matched a row that assumed encryption.

The milder version shows up in hacktivism.

NoName057(16) is tracked as organisationally distinct from Killnet.

The two brands coordinate.

NoName057(16)’s operators have been documented cooperating with Cyber Army of Russia Reborn and Z-Pentest.

Separate actors that cooperate, or fragments of one looser network wearing different public names?

Genuinely unsettled in open reporting.

A threat model that gives each Telegram brand its own tidy row is recording more structure than anyone can see.

A retired name is not a retired capability.

And a live name is not a bounded organisation.

5. “But We Map Everything to ATT&CK, So the Vocabulary Is Stable.”

Better.

Behaviour survives renames far better than labels do.

But “ATT&CK” is three separately maintained matrices, not one.

As of v19.2:

Matrix	Tactics	Techniques	Sub-techniques
Enterprise	15	222	475
Mobile	12	77	47
ICS	12	79	18

They evolve on independent schedules.

In the April 2026 v19 release, Enterprise divided Defense Evasion into Stealth, which kept TA0005, and the new Defense Impairment, TA0112.

Mobile still has a single Defense Evasion tactic, TA0030, with 17 techniques.

ICS still has a single Evasion tactic, TA0103, with 7.

So “Defense Evasion” written without a matrix is already ambiguous.

Accurate for Mobile.

No longer the name of anything in Enterprise.

And TA0005 is still there, meaning something narrower than it did.

The divergence is not only in names.

ICS carries tactics with no Enterprise or Mobile equivalent at all.

Inhibit Response Function, TA0107, with 13 techniques: preventing safety, protection or quality-control functions from responding to a hazardous condition.

Impair Process Control, TA0106, with 4: manipulating the physical process itself.

There is no analogue when the target is a laptop.

A group profile mapped only to Enterprise says nothing about what the same people would do against a plant.

A stable identifier with a shifted scope is exactly the kind of drift nobody notices in a spreadsheet.

The cadence is fixed and public. Releases land roughly every six months, April and October; v18.1 ran from 28 October 2025 to 27 April 2026.

That is manageable.

Only if you record which version and which matrix you mapped against.

A tactic name without a matrix and a version is a label too.

6. “But the Board Wants to Know Who Is Attacking Us, Not Which Cluster.”

Of course it does.

“Who” is a satisfying answer.

Some schemes are built to deliver it instantly. “Cozy Bear” tells a reader Russian-attributed before any report is opened.

That legibility is a feature of CrowdStrike’s naming.

It is not extra evidence.

It also contains every problem above.

Microsoft replaced its old naming pools, elements, trees, volcanoes and DEV-#### placeholders, with a weather-themed taxonomy in April 2023.

Typhoon for China. Sandstorm for Iran. Sleet for North Korea. Blizzard for Russia. Tempest for financially motivated actors.

It published a mapping file, and committed to prioritised in-product updates by September 2023.

A 2022 briefing that named PHOSPHORUS, NOBELIUM and ZINC was describing what current reporting calls Mint Sandstorm, Midnight Blizzard and Diamond Sleet.

Nothing changed but the names.

A board that read two briefings a year apart could reasonably conclude three adversaries left and three arrived.

Give the board the name.

Then give it the status: which vendor named the group, whether the label is provisional, and how confident the attribution is.

Then tell it what the money is actually buying.

Detection and resistance for behaviour that stays put when the label moves.

The board funds controls. Controls do not care what the attacker is called.

7. No, This Does Not Mean Attribution Is Worthless.

The opposite mistake is just as lazy.

Dropping names entirely throws away real signal, and makes every report harder to compare.

A name carried with its ATT&CK G#### ID, the naming vendor and a stated confidence is useful shorthand.

It tells you whose reporting to read next.

It links your incident to other people’s.

And some links rest on considerably more than one vendor’s clustering.

Wizard Spider, behind Trickbot, Ryuk and Conti, is tracked by most vendors as a criminal enterprise. In February 2023, the US and UK jointly sanctioned seven individuals tied to it, and the UK government assessed that key members “highly likely maintain links to the Russian Intelligence Services.”

That is two governments’ own language.

Not a cryptonym.

The point is narrower.

The name is an annotation on a decision.

It is not the thing the decision rests on.

8. What You Should Actually Do

Record every actor reference as a tuple, not a word. ATT&CK G#### ID, naming vendor, report date, stated confidence.

“APT29” alone is not a record.

Check Microsoft-sourced names against April 2023. A report using PHOSPHORUS, NOBELIUM or ZINC predates the renaming. Map it before a duplicate row appears.

Treat UNC and Storm-#### clusters as provisional. Flag them in the threat model. Revisit them when vendors merge or graduate clusters, because the boundary you planned against may move.

Require more than a single matching indicator before an attribution changes a control decision. Olympic Destroyer’s matching fingerprint was the forged part. Ask what infrastructure and tradecraft say independently.

Tie detections and threat-model entries to observed techniques. Record the matrix and the ATT&CK version beside each one. “Stealth, TA0005, Enterprise v19” is a record. “Defense Evasion” is a guess.

Re-review entries when a tracked group retires its brand. Do not close the row. Ask where the personnel went, and whether the successor changed business model.

Keep umbrella names at umbrella precision. “A cluster tracked under the Lazarus umbrella” is longer. It is also accurate.

9. The Model Is Not Complicated.

A name tells you whose telemetry saw something. Behaviour tells you what to defend against.

Names merge.

Names get forged against.

Names retire while the people keep working.

Even ATT&CK, the vocabulary you would fall back on, changes shape twice a year and differs by matrix.

So record the name.

Date it.

Say who assigned it and how sure they were.

Then key the control to the behaviour, with the matrix and version written down beside it.

The adversary does not keep your labels.

Your threat model should not depend on them.