Microsoft Security Blog: Announcing a new strategic collaboration to bring clarity to threat actor naming

Jun 2, 2025

—

Source URL: https://www.microsoft.com/en-us/security/blog/2025/06/02/announcing-a-new-strategic-collaboration-to-bring-clarity-to-threat-actor-naming/
Source: Microsoft Security Blog
Title: Announcing a new strategic collaboration to bring clarity to threat actor naming

Feedly Summary: Microsoft and CrowdStrike are teaming up to create alignment across our individual threat actor taxonomies to help security professionals connect insights faster.
The post Announcing a new strategic collaboration to bring clarity to threat actor naming appeared first on Microsoft Security Blog.

AI Summary and Description: Yes

**Summary:** The text discusses a new collaboration between Microsoft and CrowdStrike aimed at harmonizing threat actor naming conventions to improve cybersecurity response times and clarity. By aligning their threat actor taxonomies, they seek to enhance the confidence and efficiency of security professionals when responding to cyber threat intelligence.

**Detailed Description:**
The announcement highlights the following major points relevant to security professionals:

– **Criticality of Timeliness:** In today’s cyber threat environment, rapid response is essential in preventing attacks like ransomware. Delayed responses can occur due to challenges in threat actor attribution, often caused by:
– Inaccurate or incomplete data.
– Inconsistent naming conventions across different security platforms.

– **Guidance from NIST:** The National Institute of Standards and Technology (NIST) provides guidelines (SP 800-150) on threat sharing which emphasize the importance of consistent categorization and terminology in improving threat analysis and response efforts.

– **Joint Effort:** Microsoft and CrowdStrike’s collaboration aims to:
– Create alignment in their respective threat actor taxonomies.
– Map overlapping knowledge of threat actors, facilitating faster, more confident decision-making for security professionals.

– **Taxonomy Naming Challenges:** Different organizations may refer to the same threat actor by various names (e.g., “Midnight Blizzard” by Microsoft vs. “Cozy Bear” by others). This inconsistency can result in confusion and hinder effective communication among security teams.

– **New Reference Guide:** The joint effort produced a reference guide that includes:
– A list of common threat actors as tracked by both companies with their respective taxonomy mappings.
– Corresponding aliases for streamlined communication among security teams.

– **Benefits of the Guide:**
– **Improved Confidence:** Enhances identification processes for threat actors.
– **Streamlined Correlation:** Facilitates easier correlation of data across different platforms and reports.
– **Faster Action:** Allows defenders to act swiftly when confronted with active threats.

– **Future Collaborations:** The text anticipates contributions from other organizations, including Google/Mandiant and Palo Alto Networks, signaling the need for community-wide efforts to enhance defensive security measures.

This collaborative endeavor illustrates a proactive approach to standardizing threat intelligence, which is critical for security and compliance professionals in an ever-evolving threat landscape.

1 2 2025 5 800 a Act active threats AI alignment alt analysis and anti API app ARM as attack attacks attribution Axon by C challenges CI co Col collaboration collaborative communication community companies compliance compliance professionals consistency Cozy Bear critical cross crowd CrowdStrike cyber cyber threat cyber threat intelligence cybersecurit Cybersecurity cybersecurity response D data day de decision decision-making Defender DNI dual e edge effective efficiency end environment event fast first for front future g Gen Go Google gs guidance guidelines H harm high Highlight HR http HTTPS in insights Intel intelligence io Iron IRS J k knowledge l Labor land led Li low M making man Mandiant measures Micro Microsoft Microsoft Security Microsoft Security Blog mid Midnight Blizzard ML my N Naming Conventions nation National Institute of Standards and Technology National Institute of Standards and Technology (NIST) network networks NIST no o of on organization organizations oS over Palo Alto Palo Alto Networks platform platforms point post pre proactive process processes professionals R rack ransom ransomware rapid response rate RCE red Reference Guide report response Response Efforts response times responses Ro s sam sec security security and compliance security measure security measures security platform security professionals security teams SHA sharing Sig Signal size source SSE standards strategic Swift T Taxonomies taxonomy team teaming Teams tech technology terminology text the threat threat actor threat actors threat analysis threat intel threat intelligence threat landscape threats Time Timeliness to Tor TP two UI up US use V Ware Wi x