Googleâs top hacker hunter explains why hacking groups get codenames
For more than a decade, the cybersecurity industry has been assigning names to different hacking groups. Some of them, like Fancy Bear, have crossed over
For more than a decade, the cybersecurity industry has been assigning names to different hacking groups. Some of them, like Fancy Bear, have crossed over into the mainstream because of their prominent hacks and memorable names. Others are only known within the cybersecurity industry. Oftentimes, even industry insiders canât keep track. In part, thatâs because every company names hacking groups differently. Thatâs why there are resources like this one, which attempt to be a one-stop shop where cybersecurity professionals, government officials, policymakers, journalists, and the wider public can make sense of who is who. Last month, Google became the latest company to revamp its naming system for hacking groups. Gone are the days APT1, APT41 or APT whatever number, which was the system adopted by Mandiant, once an independent security firm thatâs now part of Google. Mandiant was the first to adopt a naming scheme. From now on, Googleâs system is relatively simple: A hacking group will have a first name that is memorable and random, and a second word whose initial indicates the country of origin: Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia.
According to Shane Huntley, the chief technology officer of Google Threat Intelligence Group, the companyâs in-house hacker hunting team, the revamp was necessary to bring clarity to security researchers both inside the company and externally. In the early 2010s, when companies started publishing reports on cyberattacks and naming the hackers behind them, Huntley told TechCrunch that, âwe were not expecting to have as many threat groups as we do today.â It had become hard to keep track of everyone. Google now tracks more than 5,000 âactivity clustersâ in several countries, according to John Hultquist, chief analyst at Google Threat Intelligence Group. Huntley said that there are very few developed nations that donât have their own cyber capabilities and hacking groups. But what is the point of naming hacking groups? Itâs not just an academic exercise, Huntley explained. The goal is to have a baseline understanding of who is attacking who, and how they are attacking them. That way organizations can recognize threats more quickly, prepare against them, ideally stop them, or at least investigate incidents more promptly.
All that, he said, itâs possible only if you name the hackers and track them consistently. âIf you actually get hacked by them or youâre dealing with some incident, knowing how that actor behaves, what they do, what theyâve done in the past, all of these details become critically important to help the response and also work out your coverage against these threats as well,â said Huntley. Knowing how the North Korean government hackers known as the Lazarus Group behaves, what their goals usually are, and who they work for, gives defenders a starting point in dealing with these hackers. Tracking state- hackers, while challenging, is easier than tracking cybercriminal groups and hackers-for-hire, Huntley explained. The government hackers tend to have more consistent targets and activities, while cybercriminal groups have members that come and go, sometimes splinter, and otherwise are more amorphous. Hacker-for-hire groups and spyware makers tend to have a lot of customers in different parts of the world, making them slightly harder to track. A common criticism whenever a new naming system gets announced is: Why donât all companies and organizations just use the same codenames?
The BriefWire