Google's top hacker hunter explains why hacking groups get codenames

For more than a decade, the cybersecurity industry has assigned names to different hacking groups. Some, like Fancy Bear, have crossed into the mainstream because of their prominent hacks and memorable names, while others are known only within the industry. Even insiders can struggle to keep track, in part because every company names hacking groups differently.

Last month, Google became the latest company to revamp its naming system. Gone are labels like APT1 and APT41, the system originally adopted by Mandiant, once an independent security firm that is now part of Google and was the first to build a threat-actor naming scheme. Google’s new system is simpler: a hacking group gets a first name that is memorable and random, plus a second word whose initial indicates its country of origin — Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia.

Shane Huntley, chief technology officer of the Google Threat Intelligence Group, the company’s in-house hacker-hunting team, said the revamp was needed to bring clarity to security researchers both inside and outside Google. Huntley said that in the early 2010s, when companies started publishing reports on cyberattacks and naming the hackers behind them, the industry did not expect to have as many threat groups as exist today. Google now tracks more than 5,000 “activity clusters” across several countries, according to John Hultquist, chief analyst at Google Threat Intelligence Group, and Huntley said there are very few developed nations without their own cyber capabilities and hacking groups.

Naming hacking groups isn’t just an academic exercise, Huntley explained: it gives defenders a baseline understanding of who is attacking whom and how, so organizations can recognize threats faster, prepare against them, and investigate incidents more promptly. Tracking state-sponsored hackers, he said, is easier than tracking cybercriminal groups and hackers-for-hire, since government hackers tend to have more consistent targets and activities, while cybercriminal groups splinter and have members who come and go, and hacker-for-hire outfits serve customers across many countries, making them harder to follow.

Huntley acknowledged the limits of the approach: “No one has perfect visibility,” he said. “We are building our model and our best understanding, but we will never know everything about what’s going on.” By unifying the naming scheme of Google’s old Threat Analysis Group, which Huntley previously headed, with Mandiant’s, the company says there’s now one fewer scheme for the industry to remember.

Why it matters

Consistent threat-actor naming shapes how quickly companies and governments can recognize and respond to cyberattacks, and Google folding two major schemes into one signals how much consolidation is still happening inside the fragmented cybersecurity-intelligence industry.