One hacker, many names: Industry collaboration aims to fix cyber threat label chaos – Source: www.csoonline.com

When the same Russian hacking group goes by Midnight Blizzard, Cozy Bear, APT29, or UNC2452, depending on which security vendor is tracking them, you know there’s a problem.

Microsoft and CrowdStrike have announced that they are working together to solve one of cybersecurity’s most persistent headaches: the confusing web of names used to identify the same threat actors across different security platforms.

While these two firms are leading the initial effort, Google’s Mandiant and Palo Alto Networks’ Unit 42 have agreed to contribute, Microsoft said in a statement.

The partnership creates a shared mapping system that aligns threat actor attribution across both companies’ intelligence ecosystems. The goal is simple — eliminate the delays and confusion caused by inconsistent naming conventions that have plagued security teams for years.

“Adversaries hide behind both technology and the confusion created by inconsistent naming,” Adam Meyers, head of counter-adversary operations at CrowdStrike, said in a statement. “As defenders, it’s our job to stay ahead and to give security teams clarity on who is targeting them and how to respond.”

The real cost of name confusion

This naming chaos has serious operational consequences. Security analysts lose between 15-30% of their time trying to figure out if different names like “Lazarus Group,” “Hidden Cobra,” or “TEMP.Hermit” — all refer to the same hostile entity, according to Brijesh Singh, additional director general of police for the Government of Maharashtra, India, who specializes in cybercrime and cybersecurity.

Take, for instance, the notorious Russian state-sponsored group behind the SolarWinds breach. Microsoft calls it Midnight Blizzard, but security teams might encounter it as Cozy Bear, APT29, NOBELIUM, UNC2452, Dark Halo, or any of more than 10 other names across various security firms.

“Security teams often get several alerts about the same group of attackers, but each alert uses a different name. This means they waste time chasing the same issue multiple times,” Singh explained. “Precious time needed to react quickly to an attack is lost while teams are busy correlating threat names.”

Kumar Avijit, vice president at Everest Group, pointed to instances where the confusion has real consequences. “In practice, the coexistence of multiple aliases for the same adversary has hampered security teams’ ability to quickly correlate intelligence feeds, share findings, and prioritize response actions,” Avijit said. “This mismatch can lead to duplicated efforts, delaying incident response, and leave gaps in coverage when defenders assume they are tracking distinct threats.”

Building a translation guide, not a standard

The collaboration is analyst-driven, focusing on harmonizing known adversary profiles through direct cooperation between the companies’ threat research teams. Already, the effort has led to alignment on more than 80 threat actors, confirming connections that had previously been uncertain.

The companies describe their effort as creating a “Rosetta Stone” for cyber threat intelligence — a reference guide that translates threat actor names across naming systems without forcing anyone to adopt a single industry standard.

Microsoft’s weather-themed taxonomy categorizes actors into five groups: nation-state actors, financially motivated actors, private sector offensive actors, influence operations, and groups in development. Weather families indicate either country attribution — Typhoon for China, Blizzard for Russia — or motivation, such as Tempest for financially motivated actors.

The collaboration validates specific connections, such as confirming that CrowdStrike’s Vanguard Panda and Microsoft’s Volt Typhoon both represent the same China-nexus threat group. Similarly, Secret Blizzard and Venomous Bear have been identified as aliases for a known Russian state-affiliated actor.

“This effort is not about creating a single naming standard,” Vasu Jakkal, corporate vice president at Microsoft Security, said in the statement. “Rather, it’s meant to help our customers and the broader security community align intelligence more easily, respond faster, and stay ahead of threat actors.”

“While advisory names could have effectively been used for correlations, the lack of standard naming was a big challenge,” said Sunil Varkey, advisor at Beagle Security. “Correlations were mainly happening through TTP-based correlation, IoC, or other methods, which gave only fragmented views, leading to delayed responses, analyst fatigue, and inconsistencies.”

Challenges ahead

Despite the promise, experts identify several potential hurdles that could complicate implementation. Singh notes that different security companies might have varying levels of certainty about who is behind an attack, making it complicated to agree on a single name when confidence levels differ.

“Cyber attacker groups don’t stay static. They might split up or join forces with others, making it hard to keep naming consistent over time,” Singh explained. He warns that attackers targeting specific regions could be overlooked: “Attackers specifically targeting India, such as ‘SideWinder’ or ‘Transparent Tribe,’ might not be as well-known globally and could be overlooked in a global naming system.”

Singh emphasized the broader implications for developing regions: “When new attacks or attacker groups appear, updating the shared naming system might take time, meaning the information could be slightly behind the real-time threat landscape.”

Avijit pointed out that every time a vendor introduces a fresh label — Microsoft renaming “Strontium” to “Forest Blizzard” or CrowdStrike coining “Kryptonite Panda” — the mapping registry needs updating. “Failing to promptly incorporate these changes risks reintroducing the confusion the initiative seeks to solve,” he said.

A good analogy is the cyclone naming system, which evolved through decades of international coordination to solve confusion during weather emergencies — much like what the cybersecurity world is now attempting, Varkey said.

Further reading: