Microsoft Threat Actor Naming Convention: Decoding Typhoon, Blizzard, and Storm

By Mirko Peters · 2026-10-24

Learn how Microsoft names cyber threat actors using Typhoon, Blizzard, and Storm labels. Understand adversary motives and origins easily.

Discover how Microsoft categorizes and names cyber threat actors using the elements—such as Typhoon for China, Blizzard for Russia, and Storm for unverified groups. Learn how decoding these operational handles helps security teams quickly identify attack origins, motives, and techniques without needing a deep cybersecurity background.

Key Takeaways

• Microsoft correlates threat actor family names with their geographic origin or primary operational motive.
• Typhoon designates actors originating from or aligned with China, while Blizzard points to Russia.
• Sleet represents North Korea, Sandstorm maps to Iran, and Tempest identifies financially motivated criminals.
• Temporary labels like 'Storm-0558' are used for active threats before full attribution is confirmed.
• Understanding threat actor names helps IT generalists translate alarming security reports into actionable, contextual intelligence.

Decoding Microsoft's Threat Actor Naming System

When security teams open their daily incident reports, they are often bombarded with technical jargon and randomized identification codes. To make these threats easier to digest and track across the global security landscape, Microsoft overhauled how it categorizes adversary groups. Instead of relying on obscure hexadecimal strings or forcing defenders to memorize conflicting vendor names, Microsoft mapped threat groups to weather-related family names.

This naming convention is not random. Every single word in a threat actor profile carries deliberate contextual meaning, helping analysts immediately understand where an attack is likely coming from and what the adversary hopes to achieve. Whether you are an IT administrator managing a hybrid enterprise or a decision-maker trying to make sense of cybersecurity headlines, learning this taxonomy turns chaotic noise into structured, actionable knowledge.

How Family Names Signal Geographic Origin

The foundation of Microsoft's naming system rests on the primary family name assigned to a threat group. These geographic tags establish the presumed origin or sponsorship of the cyber operations:

• Typhoon: Groups attributed to or operating from China, frequently engaging in long-term espionage against government agencies, think tanks, and critical infrastructure.
• Blizzard: Adversaries originating from or tied to Russia, often associated with state-sponsored intelligence gathering and high-profile geopolitical disruptions.
• Sandstorm: Threat actors linked to Iranian state interests, typically targeting regional rivals, defense contractors, and telecommunications.
• Sleet: Groups associated with North Korea, heavily focused on cryptocurrency theft, financial institution breaches, and strategic intelligence.

By connecting a prefix like Typhoon or Blizzard to an incident, security professionals instantly gain high-level geographic context about who might be knocking on their digital doors.

Identifying Motives Through Operational Focus

Beyond geography, Microsoft's naming architecture explicitly categorizes what drives these attackers. The secondary modifier or specific family designation highlights the adversary's primary objective:

• Tempest: Reserved exclusively for financially motivated cybercriminal syndicates, such as ransomware operators and sophisticated phishing groups.
• Flood: Applied specifically to influence operations and coordinated disinformation campaigns designed to alter public perception rather than steal data.
• Tsunami: Tracks private-sector offensive actors—commercial companies that build, package, and sell cyber weapons to various paying clients.

This clever distinction allows organizations to differentiate between a nation-state trying to quietly siphon intellectual property and a financially motivated ransomware crew looking to lock down workstations for an extortion payout.

The Purpose of 'Storm' Labels in Early Investigation

One of the most common points of confusion for teams exploring threat intelligence is encountering designations like Storm-0558. When Microsoft detects malicious activity that is clearly organized and active, but the definitive identity, nation-state backing, or long-term sponsorship of the group remains unconfirmed, it assigns a temporary placeholder label.

The word Storm followed by a four-digit number indicates that the activity is entirely real and dangerous, but the attribution is still under active investigation. Once Microsoft's security researchers gather enough definitive evidence—such as overlapping code, shared infrastructure, or specific tactics, techniques, and procedures (TTPs)—the group graduates from a temporary Storm label to a formal, permanent weather family name.

Bridging the Gap with Industry Aliases

Different cybersecurity vendors have historically used completely different names for the exact same threat groups, leading to massive confusion during cross-company incident responses. Microsoft actively maps its internal naming taxonomy to legacy industry equivalents. For example, the Russian group known internally by Microsoft as Forest Blizzard is widely tracked across the industry as Fancy Bear or APT28.

This transparent cross-referencing ensures that whether an analyst is reading a threat briefing from Microsoft, a competing cloud provider, or an open-source intelligence feed, they can instantly recognize that all three reports are describing the exact same adversary. It eliminates guesswork and streamlines multi-vendor collaboration during major security incidents.

Conclusion

Making sense of modern cybersecurity threats requires more than just reacting to blinking lights and error logs; it requires understanding the human adversaries operating behind the screen. By utilizing structured naming conventions like Typhoon, Blizzard, and Storm, Microsoft helps organizations contextualize alerts and connect isolated technical indicators to broader criminal and nation-state campaigns.

To dive deeper into passive DNS, indicators of compromise, and how to leverage these insights inside your enterprise, Listen to the full episode of the M365 FM Podcast for a complete, jargon-free breakdown of modern threat intelligence strategies.

Frequently Asked Questions

What does the term 'Blizzard' mean in Microsoft threat intelligence?

Blizzard is a family name used by Microsoft to designate threat actors and cyber operations originating from or aligned with Russia, typically focusing on espionage and geopolitical intelligence gathering.

Why does Microsoft use 'Storm' labels instead of names?

Storm labels are temporary designations assigned to newly discovered, active threat clusters when the underlying identity or nation-state sponsorship of the group is still being investigated by security researchers.

How do Tempest groups differ from Typhoon groups?

Tempest groups are financially motivated criminals focused on extortion, ransomware, and profit, whereas Typhoon groups are state-sponsored or aligned entities operating out of China primarily focused on espionage.

Do other security vendors use Microsoft's threat actor names?

Other vendors often use their own naming conventions (such as APT numbers or animal names), but Microsoft actively maps its weather-based names to industry equivalents like APT28 or Fancy Bear to ensure cross-vendor clarity.