Why Hacking Groups Get Codenames: Google Explains

Last month Google introduced a new naming system for hacking groups, dropping familiar labels like APT1 or APT41. That numbering came to the company from Mandiant — once an independent firm, the first in the industry to start assigning groups codenames, and now part of Google.

The new scheme is relatively simple. Each group gets a first name — memorable and random — while the second word points to the country of origin by its first letter: Castle for China, Ion for Iran, Neptune for North Korea and Relic for Russia.

According to Shane Huntley, technical director of the Google Threat Intelligence Group, the overhaul was needed for clarity — for both internal and external researchers. In the early 2010s, when companies were just beginning to publish reports on cyberattacks and to name the groups behind them, no one expected there would be so many of them. Today Google tracks more than 5,000 “activity clusters” across various countries, notes the division's chief analyst, John Hultquist. There are hardly any developed states left without cyber units of their own.

Why give them names at all

Huntley stresses that this is not an academic exercise. The goal is to have a basic sense of who is attacking whom, and by what means. That way organizations recognize threats faster, prepare for them, and investigate incidents more quickly. Knowing how, say, the North Korean group Lazarus behaves, what its targets are and who it works for gives defenders a starting point.

Tracking state-sponsored groups, for all its difficulty, is easier than tracking cybercriminals and hackers for hire. Government teams have more consistent targets and a more consistent style, whereas criminal groups are fluid: members come and go, collectives splinter. Mercenaries and spyware developers, meanwhile, work for a multitude of clients around the world, which muddles the picture even further.

Why not just agree on a single set of names

With any new system, one question inevitably comes up: why don't companies use unified codenames? The answer, according to Huntley, lies in the very nature of observation. Every firm has its own telemetry and its own view of one and the same group, and that can't be resolved by simply exchanging data.

“No one has perfect visibility,” he says. “We build our model and our best understanding, but we'll never know everything that's happening.” By merging the earlier schemes of the Google Threat Analysis Group and Mandiant, the company at least spared the industry one redundant naming system. For everything else, you still have to consult the vast cross-reference tables.

Source: TechCrunch