How threat actors get their names

Ever wondered where threat actors got their names from? Names like the infamous Lazarus Group, APT42, Fancy Bear and others? Well, were here to find out!

The Lazarus Group, widely thought to be the nation state actor North Korea, first came on the radar of security professionals in 2009. Their first known campaigns were conducting Distributed Denial of Service (DDoS) attacks against South Korean and US websites. The group is also believed to be behind the infamous WannaCry ransomware attack in 2017. As well as a recent $1.5 Billion crypto heist of ByBit.

The "Lazarus Group" is not the only name attributed to this threat actor. They're also referred to as "Guardians of Peace", "Whois Team", "Hidden Cobra", "ZINC" "APT38" and "Dimond Street".

And rather less l33t sounding, it is believed that within North Korea itself, the groups is known as "414 Liaison Office".

But who assigns these fancy names?

The names largely come from  Cyber Threat Intelligence (CTI) vendors, such as antivirus and other threat intelligence focused companies. Some of these companies include CrowdStrike, Kaspersky, Mandiant, and Microsoft.

These organisations will all assign names to threat actors differently; using their own naming conventions. They also assign different names to the same threat actors. Making it difficult for cyber security teams to keep track.

Here are some of the names given to the Lazarus Group by different organisations:

• Lazarus Group (Novetta/Kaspersky)
• Labyrinth Chollima (CrowdStrike)
• Diamond Sleet, fka ZINC (Microsoft)
• G0032 (MITRE ATT&CK)
• HIDDEN COBRA (CISA/US DHS)
• NICKEL ACADEMY (Secureworks)
• Guardians of Peace (self-given)
• New Romantic Cyber Army Team (McAfee)
• Whois Hacking Team (McAfee)
• Group 77 (Talos)
• Appleworm (origin unknown)

Source: https://eurepoc.eu/publication/apt-profile-lazarus-group/

CrowdStrike

CrowdStrike use animals in their naming convention, such as "Bear" for Russian nation state threat actors. "Kitten" for Iran. "Chollima" for North Korea. Or "Spider" for cybercrime.

Mandiant

Mandiant, now owned by Google, were the first to use the APT[integer] naming convention, by attributing APT1 to the Chinese Government in 2013. Although the term itself, "advanced persistent threat", is cited as originating in the United States Air Force in 2006. Mandiant uses the "UNC" naming convention for uncategorized groups. But will also use "APT" and "FIN" groups.

Microsoft

Microsoft used to use the periodic table for naming threat actors. I guess they ran out of elements? But since 2023, they now use... weather events?!

Conclusion

It would be difficult for all organisations to agree on a name for threat actors, as attribution is hard and messy, and usually takes a lot of time to do right. So anyone can name any threat actor what they like, using their own naming conventions. The names are usually first used by companies investigating APTs and then widely used by the cyber security community.

"There is no ultimate arbiter of APT naming conventions" - https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors

There are, however, some threat actor lists that are regularly updated by various trusted organisations; one being the MITRE ATT&ACK Groups, and Google Cloud's APT page.

And here comes the obligatory plug. If you want to track any of these threat actors, CyberAlerts can help you do so by creating a search query with the threat actor's name. Below is a screenshot of someone (me) monitoring the "Russia" keyword:

Microsoft Publicly Disclosed Threat Actor Names

The following table lists Microsoft's publicly disclosed threat actor names from March 14th, 2025, with their origin or threat actor category, previous names, and corresponding names used by other security vendors where available.

Source: https://learn.microsoft.com/en-gb/unified-secops-platform/microsoft-threat-actor-naming