Cybersecurity Policy Report, CrowdStrike, Microsoft Try to Harmonize Cyber Threat Naming Conventions, (Jun 2, 2025)
Organizations Mentioned:CrowdStrike
The different names given to individual cyber threat groups—for example, Microsoft Corp.’s “Salt Typhoon” is the same as CrowdStrike’s “Operator Panda”—cause confusion that Microsoft and CrowdStrike hope to resolve with a new partnership.
The two companies today announced a “collaboration to bring clarity and coordination to how cyber threat actors are identified and tracked across security vendors.”
“The cybersecurity industry has developed multiple naming systems for threat actors,” the companies noted in a news release. “These taxonomies provide critical adversary context to help organizations understand the threats they face, who is targeting them, and why. But as the adversary landscape grows, so does the complexity of cross-vendor attribution.”
“CrowdStrike and Microsoft have developed a shared mapping system—a ‘Rosetta Stone’ for cyber threat intelligence—that links adversary identifiers across vendor ecosystems without mandating a single naming standard,” they said.
“By reducing ambiguity in how adversaries are labeled, this mapping enables defenders to make faster, more confident decisions, correlate threat intelligence across sources, and better disrupt threat actor activity before it causes harm,” they added.
The naming systems used by individual vendors have internal consistency; Microsoft identifies Chinese threat actors using “Typhoon” in their names, while CrowdStrike uses “Panda.” Russian threat actors are “Blizzards” at Microsoft and “Bears” at CrowdStrike.
“While a single universal naming standard is not practical and may not be possible, defenders shouldn’t have to spend countless cycles trying to delineate if COZY BEAR is the same as APT29, or UNC2452, or Midnight Blizzard,” according to a blog post by Adam Meyers, CrowdStrike’s head–counter adversary operations.
“Through mutual effort and analyst-led deconfliction, we will combine resources to maintain a mapping for the community, and make it available to all those who engage these adversaries on the cyber battlefield,” Mr. Meyers said.
“CrowdStrike and Microsoft are proud to take the first step, but we know this must be a community-led initiative to succeed,” he added. “Together, the companies have already deconflicted more than 80 threat actors through direct, analyst-led collaboration.”
News: InternationalLegislation DataSecurity