Skip to content

Response, New York. Noah Park: Check Point Patches Actively Exploited Management Server Path Traversal. Detection, Dallas. Ava Okello: Report Finds Nearly Half of Deployed Detections Need Attention Before SOCs Can Trust Them.

SOCtember

Always First. Fast SOC News.

Microsoft Learn page titled How Microsoft names threat actors, showing weather family icons.
Screenshot: Microsoft Learn, How Microsoft names threat actors, last updated October 21, 2026 (fair use).

Threat Intel

Did You Know: One Threat Group Can Go by More Than a Dozen Names, and Those Names Are Not Exact Matches

MITRE ATT&CK lists 14 other names for APT29, including Midnight Blizzard and Cozy Bear, but says its Associated Groups are not exact overlaps. Microsoft's weather-based names and its published cross-reference reflect its own analysis. Alias tables help analysts find reporting; the original sources decide whether indicators belong under one actor.

Priya Shah, Threat IntelSingapore3 min read

SINGAPORE - The same intrusion set can appear in one report as APT29, in another as Midnight Blizzard and in a third as Cozy Bear. MITRE ATT&CK describes groups as activity clusters that are tracked by a common name in the security community, and says some groups have multiple names associated with similar activities because various organizations track similar activities by different names. Its APT29 entry lists 14 Associated Groups, among them NOBELIUM, UNC2452, The Dukes, Cozy Bear and Midnight Blizzard. Its APT28 entry lists 15, including Fancy Bear, Sofacy, STRONTIUM, Forest Blizzard and Swallowtail.

Microsoft Learn section explaining family names, adjectives and Storm designations, with the family name table.
Screenshot: Microsoft Learn, family names and Storm designations in How Microsoft names threat actors (fair use).

The catch is in MITRE's own caveat. It says organizations' group definitions may partially overlap with groups designated by other organizations and may disagree on specific activity. MITRE tracks overlaps between names based on publicly reported associations, labels them Associated Groups on each page (formerly Aliases), and states that it does not represent these names as exact overlaps and encourages analysts to do additional research. Its Andariel entry shows why: MITRE says Andariel is considered a subset of Lazarus Group, says North Korean group definitions are known to have significant overlap, and notes that some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

MITRE ATT&CK Groups overview explaining that Associated Groups are not exact overlaps.
Screenshot: MITRE ATT&CK, Groups overview (fair use).

Vendor names also encode the vendor's own analysis. Microsoft says it uses a weather-based naming taxonomy. For nation-state actors, the family name is assigned to a country or region of origin tied to attribution, so Typhoon indicates China; for other actors it represents a motivation, so Tempest indicates financially motivated actors. Within a family, an adjective distinguishes groups with distinct tactics, techniques and procedures, infrastructure, objectives or other identified patterns. A newly discovered or developing cluster gets the temporary designation Storm plus a four-digit number, and once Microsoft's criteria are met it is converted to a named actor or merged into existing names. When Microsoft moved to this scheme in April 2023, it retired its earlier Elements, Trees, Volcanoes and DEV names and reassigned all existing actors, which is why names such as STRONTIUM and NOBELIUM, now listed among the other names for Forest Blizzard and Midnight Blizzard, still turn up in older reporting.

MITRE ATT&CK APT29 page listing its Associated Groups, including Midnight Blizzard and Cozy Bear.
Screenshot: MITRE ATT&CK, APT29 (G0016), version 6.2, last modified 31 July 2026 (fair use).

Microsoft publishes a cross-reference. Its Learn page lists publicly disclosed threat actor names with their origin or category, previous names and corresponding names used by other security vendors where available, and says the page is updated as more information becomes available. The same mapping is offered as a JSON file on GitHub, alongside a KQL query for looking up an actor by its old, new or industry name. The lists do not always agree. Microsoft's entry for Forest Blizzard includes APT28 and Fancy Bear but not Swallowtail, which MITRE includes for APT28; Microsoft's list carries names such as Blue Athena and CrisisFour that MITRE's APT28 entry does not. In its 2023 announcement, Microsoft said other vendors have unique naming taxonomies representing their distinct view of threats, that there are often overlaps or close alignments, and that keeping track of these names can be challenging for defenders.

SOCtember diagram comparing Microsoft and MITRE name lists for APT28, also tracked as Forest Blizzard.
Illustration: SOCtember, APT28 and Forest Blizzard name lists compared; compiled from Microsoft Learn and MITRE ATT&CK.

For a threat intelligence team, an alias table is a search aid, not a merge key. When a report arrives under one name, use the cross-references to find related reporting and existing detections. Before folding indicators or techniques from several names into one actor profile, go back to the cited reporting; MITRE maps groups to publicly reported technique use and includes the original references on each page. Microsoft describes a Storm designation as temporary, so a hunt or watchlist filed under a Storm number is worth rechecking against Microsoft's current name for that cluster. Treat each name as a claim about a specific set of activity made by a specific team.

Sources:

Priya Shah covers threat intelligence, intrusion analysis, and adversary tradecraft for SOCtember from Singapore.

Related stories

Threat Intel desk