<titleabbrev="Recommendations on naming threat actors">Recommendations on naming threat actors</title><authorinitials="A."surname="Dulaunoy"fullname="Alexandre Dulaunoy"><organizationabbrev="CIRCL">Computer Incident Response Center Luxembourg</organization><address><postal><street>16, bd d'Avranches</street>
<city>Luxembourg</city>
<code>L-1160</code>
<country>Luxembourg</country>
</postal><phone>+352 247 88444</phone>
<email>alexandre.dulaunoy@circl.lu</email>
</address></author>
<authorinitials="P."surname="Bourmeau"fullname="Pauline Bourmeau"><organizationabbrev="CIRCL">Corexalys</organization><address><postal><street>26 Rue de la Bienfaisance</street>
<city>Paris</city>
<code>75008</code>
<country>France</country>
</postal><email>info@corexalys.com</email>
</address></author>
<dateyear="2020"month="June"day="9"></date>
<area>Security</area><workgroup></workgroup>
<abstract><t>This document provides advice on the naming of threat actors (also known as malicious actors).
The objective is to provide practical advices for organisations such as security vendors or organisations attributing
incidents to a group of threat actor. It also discusses the implication of naming a threat actor towards intelligence analysts
and threat intelligence platforms such as MISP <xreftarget="MISP-P"></xref>].</t>
<sectionanchor="reusing-threat-actor-naming"title="Reusing threat actor naming">
<t>Before creating a new threat actor name, you MUST consider a review of existing threat actor names from databases such as the threat actor
MISP galaxy <xreftarget="MISP-G"></xref>. Proliferation of threat actor names is a significant challenge for the day-to-day analyst work. If your threat actor defined an existing threat actor, you MUST
reuse an existing threat actor name. If there is no specific threat actor name, you SHALL create a new threat actor following the best
