@@ -3,8 +3,8 @@ title: How Microsoft names threat actors description: Learn how Microsoft names threat actors using a weather-based taxonomy. Find the full list of tracked actors with previous names and origin details. ms.mktglfcycl: secure ms.sitesec: library-author: poliveria-ms.author: pauloliveria+author: eavena+ms.author: eravena ms.reviewer: ms.collection: - m365-security@@ -14,7 +14,7 @@ ms.custom: - msecd-doc-authoring-1012 ms.topic: article ai-usage: ai-assisted-ms.date: 07/16/2026+ms.date: 08/18/2026 ---  # How Microsoft names threat actors@@ -87,6 +87,7 @@ The following table lists publicly disclosed threat actor names with their origi |[Flax Typhoon](https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/)|China|Storm-0919, ETHEREAL PANDA| |[Forest Blizzard](https://www.microsoft.com/en-us/security/blog/tag/forest-blizzard-strontium/)|Russia|STRONTIUM, FANCY BEAR, Sednit, ATG2, Sofacy, Blue Athena, Z-Lom Team, Operation Pawn Storm, Tsar Team, CrisisFour, HELLFIRE, APT28| |[Fox Tempest](https://aka.ms/Fox-Tempest-MSaaS)|Financially motivated||+|Frontier Blizzard|Russia|UNC5792| |Ghost Blizzard|Russia|BROMINE, BERSERK BEAR, TG-4192, Koala Team, Blue Kraken, Crouching Yeti, Dragonfly| |Gingham Typhoon|China|GADOLINIUM, KRYPTONITE PANDA, TEMP.Periscope, Leviathan, JJDoor, APT40, Feverdream| |Granite Typhoon|China|GALLIUM, PHANTOM PANDA|@@ -196,14 +197,17 @@ The following table lists publicly disclosed threat actor names with their origi |[Storm-2470](https://www.microsoft.com/en-us/security/blog/2026/01/14/inside-redvds-how-a-single-virtual-desktop-provider-fueled-worldwide-cybercriminal-operations/)|Group in development|| |[Storm-2477](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)|Group in development|Lumma Stealer| |[Storm-2561](https://www.microsoft.com/en-us/security/blog/2026/03/12/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft/)|Group in development||+|Storm-2581|Financially motivated|UNC6040| |[Storm-2603](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/)|China|| |[Storm-2657](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)|United States, Financially motivated|Payroll Pirates| |[Storm-2697](https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/)|Financially motivated|| |[Storm-2755](https://www.microsoft.com/en-us/security/blog/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/)|Financially motivated||+|[Storm-2945](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/)|Group in development|| |[Storm-2949](https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/)|Group in development||-|Storm-2981|Group in development|Coinbase Cartel|-|Storm-2999|Group in development|TeamPCP|-|[Storm-3075](https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/)|Group in development||+|Storm-2981|Financially motivated|Coinbase Cartel|+|Storm-2999|Financially motivated|TeamPCP|+|[Storm-3075](https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/)|Financially motivated||+|Storm-3127|Financially motivated|UNC6240| |Strawberry Tempest|Financially motivated|DEV-0537, SLIPPY SPIDER, LAPSUS$| |Sunglow Blizzard||DEV-0665| |Swirl Typhoon|China|TELLURIUM, STALKER PANDA, Tick, Bronze Butler, REDBALDKNIGHT|@@ -227,9 +231,9 @@ Read the [threat actor naming taxonomy announcement](https://aka.ms/threatactors  ## Putting intelligence into the hands of security professionals -[Intel profiles in Microsoft Defender Threat Intelligence](/defender-xdr/defender-threat-intelligence) bring crucial insights about threat actors. These insights enable security teams to get the context they need as they prepare for and respond to threats.+[Microsoft Defender XDR threat analytics](/defender-xdr/threat-analytics) bring crucial insights about threat actors. These insights enable security teams to get the context they need as they prepare for and respond to threats. -Additionally, the Microsoft Defender Threat Intelligence Intel Profiles API provides the most up-to-date threat actor infrastructure visibility in the industry today. Updated information is crucial in enabling threat intelligence and security operations (SecOps) teams to streamline their advanced threat hunting and analysis workflows. Learn more about this API in the documentation: [Use the threat intelligence APIs in Microsoft Graph (preview)](/graph/api/resources/security-threatintelligence-overview).+Additionally, the [Microsoft Threat Intelligence APIs in Microsoft Graph](/graph/api/resources/security-threatintelligence-overview) provides the most up-to-date threat actor infrastructure visibility in the industry today. Updated information is crucial in enabling threat intelligence and security operations (SecOps) teams to streamline their advanced threat hunting and analysis workflows.  ## Resources