HiP (Hesperus is Phosphorus) is a tool that produces clusters of threat actor names assigned to the same entity by different CTI vendors. HiP leverages public catalogs (taxonomies) of threat actor names and the mappings among them. Details about its design and the main findings from our study can be found in the accompanying paper:
G. Roa, M. Suarez, J. Tapiador. Hesperus is Phosphorus: Mapping Threat Actor Naming Taxonomies at Scale, November 2025.