Google’s top hacker hunter explains why hacking groups get codenames

For much than a decade, the cybersecurity manufacture has been assigning names to antithetic hacking groups. Some of them, similar Fancy Bear, person crossed implicit into the mainstream due to the fact that of their salient hacks and memorable names. Others are lone known wrong the cybersecurity industry. 

Oftentimes, adjacent manufacture insiders can’t support track. In part, that’s due to the fact that each institution names hacking groups differently. That’s wherefore determination are resources similar this one, which effort to beryllium a one-stop store wherever cybersecurity professionals, authorities officials, policymakers, journalists, and the wider nationalist tin marque consciousness of who is who. 

Last month, Google became the latest institution to revamp its naming system for hacking groups.

Gone are the days APT1, APT41 oregon APT whatever number, which was the strategy adopted by Mandiant, erstwhile an autarkic information steadfast that’s present portion of Google. Mandiant was the archetypal to follow a naming scheme.

From present on, Google’s strategy is comparatively simple: A hacking radical volition person a archetypal sanction that is memorable and random, and a 2nd connection whose archetypal indicates the state of origin: Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia.

According to Shane Huntley, the main exertion serviceman of Google Threat Intelligence Group, the company’s in-house hacker hunting team, the revamp was indispensable to bring clarity to information researchers some wrong the institution and externally. 

In the aboriginal 2010s, erstwhile companies started publishing reports connected cyberattacks and naming the hackers down them, Huntley told TechCrunch that, “we were not expecting to person arsenic galore menace groups arsenic we bash today.”

It had go hard to support way of everyone. Google present tracks much than 5,000 “activity clusters” successful respective countries, according to John Hultquist, main expert astatine Google Threat Intelligence Group. Huntley said that determination are precise fewer developed nations that don’t person their ain cyber capabilities and hacking groups. 

But what is the constituent of naming hacking groups? It’s not conscionable an world exercise, Huntley explained. The extremity is to person a baseline knowing of who is attacking who, and however they are attacking them. That mode organizations tin admit threats much quickly, hole against them, ideally halt them, oregon astatine slightest analyse incidents much promptly. 

All that, helium said, it’s imaginable lone if you sanction the hackers and way them consistently. 

“If you really get hacked by them oregon you’re dealing with immoderate incident, knowing however that histrion behaves, what they do, what they’ve done successful the past, each of these details go critically important to assistance the effect and besides enactment retired your sum against these threats arsenic well,” said Huntley.

Knowing however the North Korean authorities hackers known arsenic the Lazarus Group behaves, what their goals usually are, and who they enactment for, gives defenders a starting constituent successful dealing with these hackers. 

Tracking state-sponsored hackers, portion challenging, is easier than tracking cybercriminal groups and hackers-for-hire, Huntley explained. The authorities hackers thin to person much accordant targets and activities, portion cybercriminal groups person members that travel and go, sometimes splinter, and different are much amorphous. Hacker-for-hire groups and spyware makers thin to person a batch of customers successful antithetic parts of the world, making them somewhat harder to track. 

A communal disapproval whenever a caller naming strategy gets announced is: Why don’t each companies and organizations conscionable usage the aforesaid codenames? While that seems similar an casual question to answer, the world is that each institution has a somewhat antithetic presumption of each group, based connected their ain sets of information and telemetry. Huntely said this is an inescapable world that can’t beryllium avoided conscionable by sharing much accusation among companies and groups of researchers. 

“No 1 has cleanable visibility,” helium said. “We are gathering our exemplary and our champion understanding, but we volition ne'er cognize everything astir what’s going on.”

By unifying the naming strategy of Google’s aged Threat Analysis Group, which Huntely headed, and Mandiant, astatine slightest present there’s 1 less strategy to remember. For everything else, refer to this gargantuan list.