The new Microsoft threat actor naming taxonom as line formated json. -> https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

new_microsoft_threat_actor_naming_taxonomy.py

from pprint import pprint

import requests

# https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
# https://www.microsoft.com/en-us/security/blog/2023/04/18/microsoft-shifts-to-a-new-threat-actor-naming-taxonomy/

URL = "https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json"


def main():
    r = requests.get(URL)
    r.raise_for_status()
    raw_json = r.json()

    data_list = []
    for entry in raw_json:
        data = {
            "threat_actor": entry["New name"],
            "sector": entry["Origin/Threat"],
            "synonyms": [entry["Previous name"]] + entry["Other names"]
        }
        data_list.append(data)

    pprint(sorted(data_list, key=lambda x: x["threat_actor"]))


if __name__ == '__main__':
    main()