Google Threat Intelligence Group

Google’s Threat Intelligence Group is unifying its hacker naming system under Mandiant and its in-house Threat Analysis Group, using two-word code names to resolve overlapping designations. The first word is memorable and often derived from prior reports, while the second categorizes groups by origin or motive. Microsoft and CrowdStrike have also adopted similar systems, with industry players collaborating to map these names for consistency.

Google has introduced a new two-word taxonomy for classifying cybercrime groups, departing from a Microsoft-led initiative to standardize naming conventions. The system, developed by Google's Threat Intelligence Group (CTIG) following its Mandiant acquisition, uses terms like CASTLE (China), ION (Iran), and NEPTUNE (North Korea) to categorize threat actors by origin and motivation. The move aims to simplify operations but contradicts prior efforts by Microsoft and CrowdStrike to unify naming across the cybersecurity industry.

The Russian state-sponsored threat actor Turla has developed a new .NET backdoor called STOCKSTAY, which has been used to target Ukrainian government and military organizations, as well as entities interested in Italian foreign policy. Google Threat Intelligence Group disclosed these details, highlighting the backdoor's ongoing development by the hacking group.

PRC-linked spies, tracked as UNC6508, infiltrated North American medical and military research networks for over a year, using custom malware to snoop through Gmail and steal sensitive data. They targeted defense-related information, drone technology, and research on the Chikungunya virus, exploiting externally facing REDCap servers to gain access.

Cybersecurity researchers revealed a data theft extortion campaign targeting U.S. organizations in professional, legal, and financial services between January and May 2026. The campaign, attributed to UNC3753, involved vishing and physical intrusions, with Google Mandiant and Google Threat Intelligence Group identifying the threat actor.

AI has entered a new era of cybersecurity threats, with Google detecting the first known case of cybercriminals using AI to exploit zero-day vulnerabilities. Senate Minority Leader Chuck Schumer is urging the Department of Homeland Security to develop a national coordination plan by July to address AI-enabled hacking risks to critical infrastructure.

Google's Threat Intelligence Group discovered a zero-day exploit made with AI and stopped a mass exploitation event. This is Google's first-ever discovery of such an exploit. The discovery highlights the effectiveness of Google's proactive measures.

Google's Threat Intelligence Group has identified a case of cybercriminals using AI to discover and exploit a zero-day vulnerability in a planned mass-hack campaign. The vulnerability was found in a popular open-source web-based administration platform and was patched before it could be widely exploited. Google believes this is the first real-world case of AI being used for such an attack.

Hackers used AI to develop a zero-day exploit targeting a popular open-source web administration tool. The exploit was discovered by researchers at Google Threat Intelligence Group. The use of AI in developing the exploit is a concerning development in the field of cybersecurity.

Google researchers discovered an AI-developed zero-day exploit before attackers could use it, alerting the susceptible vendor to patch the vulnerability. The exploit affected a popular open-source administration tool and allowed attackers to bypass two-factor authentication. This is the first time Google found compelling evidence of AI being used to develop zero-day exploits.