Google goes it alone with a new cybercrime crew taxonomy

Google has introduced a new two-word taxonomy for classifying cybercrime groups, departing from a Microsoft-led initiative to standardize naming conventions. The system, developed by Google's Threat Intelligence Group (CTIG) following its Mandiant acquisition, uses terms like CASTLE (China), ION (Iran), and NEPTUNE (North Korea) to categorize threat actors by origin and motivation. The move aims to simplify operations but contradicts prior efforts by Microsoft and CrowdStrike to unify naming across the cybersecurity industry.