Microsoft Defender XDR

Microsoft Threat Actor Naming

20 October 2026Doc update+11 / −3 lines

In brief

The page now lists Crystal Typhoon and Storm-2380, Storm-2570, Storm-2634, Storm-2990, Storm-2992, Storm-3069, Storm-3119, Storm-3168, and Storm-3189, including available aliases, classifications, and reference links. The page date was also updated and two internal authoring links were removed.

What Defender admins need to know

Administrators can use the expanded naming table to correlate threat intelligence with Microsoft’s current actor names and aliases. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

@@ -23,7 +23,7 @@ ms.custom: - msecd-doc-authoring-1012 ms.topic: article ai-usage: ai-assisted-ms.date: 2026-08-18T00:00:00.0000000Z+ms.date: 2026-10-19T00:00:00.0000000Z locale: en-us document_id: 5e5b3874-aec8-372b-d35d-f710fe4a6852 document_version_independent_id: 5e5b3874-aec8-372b-d35d-f710fe4a6852@@ -42,11 +42,9 @@ source_path: defender-xdr/microsoft-threat-actor-naming.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/63959238-cb90-4871-a33d-4a5519097e47 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1577a46d-8446-40bd-bfae-0578362f4d94-- https://authoring-docs-microsoft.poolparty.biz/devrel/029d2366-5c16-4816-8cb8-dadeaf730762 spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/78d87f42-5582-4a6b-90be-7db2f12b34e6 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/cdf3f22d-5420-4d59-a2bf-66d6b3d9c828-- https://authoring-docs-microsoft.poolparty.biz/devrel/082dcafd-01b6-47e9-8abe-5795dbab1ea9 platformId: dacb0714-ef45-4030-9983-34910a174611 --- @@ -111,6 +109,7 @@ The following table lists publicly disclosed threat actor names with their origi | [CovertNetwork-1658](https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/) | Covert network | ORB07 |
 | Crescent Typhoon | China | CESIUM |
 | Crimson Sandstorm | Iran | CURIUM, IMPERIAL KITTEN, Tortoise Shell, HOUSEBLEND, TA456 |
+| Crystal Typhoon | China | Storm-1849, UAT4356 |
 | Cuboid Sandstorm | Iran | DEV-0228, IMPERIAL KITTEN |
 | Daffodil Gust | United Arab Emirates | Stealth Falcon, Fruity Armor, Project Raven |
 | [Denim Tsunami](https://www.microsoft.com/en-us/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/) | Austria, Private sector offensive actor | DEV-0291 |
@@ -226,21 +225,30 @@ The following table lists publicly disclosed threat actor names with their origi | [Storm-2227](https://www.microsoft.com/en-us/security/blog/2026/01/14/inside-redvds-how-a-single-virtual-desktop-provider-fueled-worldwide-cybercriminal-operations/) | Group in development |  |
 | [Storm-2246](https://blogs.microsoft.com/on-the-issues/2025/09/16/microsoft-seizes-338-websites-to-disrupt-rapidly-growing-raccoono365-phishing-service/) | Group in development |  |
 | [Storm-2372](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/) | Group in development |  |
+| Storm-2380 | Group in development | DragonForce, Hackledorb |
 | [Storm-2460](https://www.microsoft.com/en-us/security/blog/2025/08/18/dissecting-pipemagic-inside-the-architecture-of-a-modular-backdoor-framework/) | Group in development |  |
 | [Storm-2470](https://www.microsoft.com/en-us/security/blog/2026/01/14/inside-redvds-how-a-single-virtual-desktop-provider-fueled-worldwide-cybercriminal-operations/) | Group in development |  |
 | [Storm-2477](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/) | Group in development | Lumma Stealer |
 | [Storm-2561](https://www.microsoft.com/en-us/security/blog/2026/03/12/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft/) | Group in development |  |
+| [Storm-2570](https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/) | Financially motivated |  |
 | Storm-2581 | Financially motivated | UNC6040 |
 | [Storm-2603](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/) | China |  |
+| Storm-2634 | China | GTG-1002 |
 | [Storm-2657](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/) | United States, Financially motivated | Payroll Pirates |
 | [Storm-2697](https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/) | Financially motivated |  |
 | [Storm-2755](https://www.microsoft.com/en-us/security/blog/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/) | Financially motivated |  |
 | [Storm-2945](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/) | Group in development |  |
 | [Storm-2949](https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/) | Group in development |  |
 | Storm-2981 | Financially motivated | Coinbase Cartel |
+| [Storm-2990](https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/) | Group in development |  |
+| [Storm-2992](https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/) | Group in development |  |
 | Storm-2999 | Financially motivated | TeamPCP |
+| [Storm-3069](https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/) | Group in development |  |
 | [Storm-3075](https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/) | Financially motivated |  |
+| [Storm-3119](https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/) | Group in development | YAM Store |
 | Storm-3127 | Financially motivated | UNC6240 |
+| [Storm-3168](https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/) | Group in development | JADEPUFFER |
+| Storm-3189 | Group in development | ExfilSquad |
 | Strawberry Tempest | Financially motivated | DEV-0537, SLIPPY SPIDER, LAPSUS$ |
 | Sunglow Blizzard |  | DEV-0665 |
 | Swirl Typhoon | China | TELLURIUM, STALKER PANDA, Tick, Bronze Butler, REDBALDKNIGHT |