This is why i'm big on tracking ACTIVITY CLUSTERS not Threat Actors. Threat Actors are humans. Unless you have HUMINT capabilities (Human Intelligence) you really shouldn't be talking about naming Threat Actors. Most CTI shops have SIGINT (Signals Intelligence). These signals being the observable techniques, logs, output of malware analysis, infrastructure tracking. You can surface ACTIVITY CLUSTERS and give them a number and move on and do a cyclical review to see if any of the clusters need to be merged or expanded. If the cluster grows to a size that is notable or is involved with an INTRUSION or CAMPAIGN that is worth discussing then this is where giving the cluster a public name is of value. To directly address the question by Raaz, the new skills and techniques observed would be a net new numbered ACTIVITY CLUSTER. The alternative is a world where we are creating what I have dubbed INTELLIGENCE DEBT where every observed signal (malware, technique, infrastructure) is constantly requiring an analyst or researcher to compare that singular object at that point in time against every named cluster to see if it 'fits'. The more that you do this the problem grows exponentially and it comes with the very real problem of infighting and conflict with other researchers who disagree with you (mainly because they have different visibility based on telemetry). A final point: I think the term APT has outlived its usefulness and has taken on many different meanings to many different peoples. I like to describe the likely motives of the HUMANS behind the activity clusters instead: Nation Enabled (either implicitly or explicitly tasked, or allowed to operate with impunity because their activities align with those that would benefit the state in question) OR Criminal (money motivated - eCrime). This model still has issues because of the moonlighting (threat actors involved in both monetarily motivate campaigns as well as being tasked by a state - we saw this evidence in the Conti leaks). eCrime is like pick-up basketball, actors are constantly working together and they learn things from each other (techniques start to blur). The same is true between Nation Enabled and eCrime. We saw this with DRPK using Click-Fix recently. Threat Actor naming mainly serves as a marketing vehicle these days amongst other things which i won't get into here. --I've been thinking about doing a talk on this topic-- but I would be remiss if i didn't mention that there are others in this industry who have a much better grasp of this subject than me like Joe Slowik.