It’s All in the Name: How Unit 42 Defines and Tracks Threat Adversaries
Summary: Unit 42 explained how it tracks threat activity, starting from artifacts and TTPs found in a single intrusion and building them into activity clusters named with a shorthand like CL-UNK-0042, based on hypothesized motivation where it can be established. Clusters must graduate to temporary threat actor groups, named TGR-{CRI | STA | MIX | UNK}-####, after correlation points are mapped to the Diamond Model of Intrusion Analysis, and Unit 42 prevents direct migration of clusters to formally named actor groups.
Why it matters: Unit 42's naming carries a built-in confidence level: a CL- or TGR- label means the actor identity is still provisional, so a report citing TGR-STA-0051 is not the same as a formal attribution, and treating it as one overstates what the intelligence supports.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026