Inside the Mind of a Google Cyber Sleuth: The Significance Behind Hacking Groups’ Codenames

The cybersecurity sector has been labeling various hacking groups for over ten years, with some, like Fancy Bear, gaining notoriety due to high-profile hacks. Others remain lesser-known, even among experts.

The naming can often confuse even seasoned professionals, as different companies adopt their own naming conventions. This has led to the creation of resources aimed at helping cybersecurity experts, officials, reporters, and the general public discern various groups.

Recently, Google updated its approach to naming these hacking groups.

The previous nomenclature system, which included designations like APT1 and APT41 from Mandiant—a firm now owned by Google—is being replaced. Mandiant was a pioneer in developing a structured naming methodology.

In the new system, each hacking group will have a catchy first name and a second word whose initial denotes the group’s country of origin: Castle represents China, Ion signifies Iran, Neptune stands for North Korea, and Relic points to Russia.

Shane Huntley, CTO of Google Threat Intelligence Group, stated that the changes aim to provide clarity for security researchers, both within the organization and beyond.

Huntley noted that back in the early 2010s, when enterprises began reporting cyber incidents and associating them with specific hackers, there was an underestimation of how many threat groups would arise.

Currently, Google tracks over 5,000 “activity clusters” globally, as highlighted by John Hultquist, the chief analyst of Google Threat Intelligence Group. Huntley remarked that there are very few developed countries without their own cyber capabilities and hacking factions.

The rationale behind naming hacking groups is not purely academic; it is essential for gaining insight into the attackers and their methods. This enables organizations to faster identify threats, prepare defenses, and ideally preempt or swiftly address incidents.

Huntley emphasized that effectively tracking hackers and naming them is vital for organizations responding to breaches.

Understanding the tactics and objectives of groups like the Lazarus Group, linked to North Korea, allows defenders to formulate initial strategies for countering these threats.

Huntley explained that while monitoring state-sponsored hackers is challenging, it is generally more straightforward than tracking cybercriminal gangs and hired hackers, as the former tend to have more stable targets and operations. In contrast, criminal organizations often have fluctuating membership and tactics.

A frequent criticism regarding new naming conventions is the desire for uniformity across all organizations. However, Huntley pointed out that every company has a unique understanding based on its individual data and intelligence. This disparity is unlikely to change even with more information sharing.

“No one has perfect visibility,” he reiterated. “We are improving our model and understanding, but complete clarity is unattainable.”

By harmonizing the naming conventions of Google’s former Threat Analysis Group and Mandiant, there is now one less naming system to remember. For those needing further details, a comprehensive list is available.