Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Unit 42 Threat Group Naming Update

Summary: Unit 42 is replacing its threat group naming policy with a constellation-based schema in which each constellation denotes a category - Libra for general cybercrime, Orion for BEC, Scorpius for ransomware, Virgo for hacktivism, and Draco, Lynx, Pisces, Serpens, Taurus and Ursa for Pakistan, Belarus, North Korea, Iran, China and Russia respectively - with a modifier word distinguishing groups inside each category. The team says it has fully remapped its internal "Rosetta Stone" of other researchers' names, will carry former names as aliases in future reports, and will assign numeric cluster identifiers such as CLU001 when attribution is not yet possible.

What you should know: Unit 42's own example is GALLIUM, a Microsoft-defined name it adopted for a group behind the PingPull remote access Trojan because it had no name of its own - so a report you read under one vendor's label may now map to a different name in Unit 42's ATOM Viewer, and the alias is the only thread tying them together.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026