Why one threat actor has many names, and how to cope

One piece of activity often has several names because each organisation clusters what it sees from its own data, on its own timeline, with its own rules. The names overlap but are rarely identical. Track behaviours and indicators in your own records, and treat a name as a pointer to a report.

Where the confusion comes from

A vendor sees one set of customers. A government agency sees another. A researcher sees a malware sample and a few servers. Each group builds a cluster from what it can observe and gives it a label.

MITRE's description of ATT&CK groups makes the root point: organisations' group definitions may partially overlap with groups designated by other organisations, and may disagree on specific activity. It also says that associated names listed on a group page come from public reporting and should not be treated as exact matches.

That is the honest state of the field. Names are working labels.

A practical example from MITRE

MITRE's page notes that North Korean group definitions are known to have significant overlap, and that some researchers report all state-sponsored activity from that country under a single name rather than separate subgroups. The same events can therefore be one group in one report and several in another.

What goes wrong in companies

• A board member reads a news story naming a group and asks if you are "protected against it". Nobody can answer, because the name maps to different technique lists in different reports.
• Two teams argue about whether an alert "is" the group from last month. They are comparing labels, not evidence.
• A ticket records a group name and nothing else, so six months later no one knows what behaviour was seen.

A tracking method that survives renaming

Keep a small record for each report you act on:

1. The title, publisher and date of the report.
2. The name the publisher used, copied exactly.
3. The behaviours you will test or detect, written as plain actions.
4. The indicators, with a note on how fast they go stale.
5. Your own status: tested, partly covered, not applicable.

When a new report arrives with a different name, compare behaviours. If the behaviours match, add a line to the existing record. If they do not, start a new record.

Do not merge names yourself

It is tempting to declare two names "the same". Unless a publisher says so and explains why, hold the two records separate and note the possible overlap. You lose little, and you avoid building a false picture.

When names are still useful

Names help you search, subscribe to updates and talk to peers. Use them for that. Just do not rest a risk decision on one.

Quick check

Sources

• MITRE ATT&CK groups

Last reviewed: 19 October 2026.