I believe that individual vendors (MSTC, FireEye, Talos, etc.) name threat actors differently. If you're interested, I'd highly recommend this page by CrowdStri

I believe that individual vendors (MSTC, FireEye, Talos, etc.) name threat actors differently. If you're interested, I'd highly recommend this page by CrowdStrike: https://adversary.crowdstrike.com/en-US/ https://adversary.crowdstrike.com/en-US/ It's very interesting to see how humans naturally tend to craft identities for faceless, nameless adversaries, which I think is very interesting from a social standpoint. Also the artwork in the website above is just plain cool IMO :) Although the vendors share information quite freely, I think there's hesitation on a vendor mutually adopting another vendor's threat actor name because it implies more substantive research on the latter's part, which is usually a no-no in a field like this. Ofc, I'm sure there are exceptions. edit: I also wanted to give Thai CERT a shout out and add a link to https://www.thaicert.or.th/downloads/files/Threat_Group_Cards_v2.0.pdf https://www.thaicert.or.th/downloads/files/Threat_Group_Card... which is less flashy than the CrowdStrike compendium, but well-detailed