Google's Hacker Hunter Reveals the Reason Behind Hacking Groups' Codenames

In a bid to bring clarity to security researchers, Google has revamped its naming system for hacking groups.

For over a decade, the cybersecurity industry has been assigning names to different hacking groups. Some, like Fancy Bear, have crossed over into the mainstream due to their prominent hacks and memorable names. Others are only known within the industry. Oftentimes, even insiders can't keep track.

The reason for this is that every company names hacking groups differently. This is why resources like Google's revamped naming system attempt to be a one-stop shop where cybersecurity professionals, government officials, policymakers, journalists, and the wider public can make sense of who is who.

Google's system is relatively simple: A hacking group will have a first name that is memorable and random, and a second word whose initial indicates the country of origin: Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia.

According to Shane Huntley, the chief technology officer of Google Threat Intelligence Group, the company's in-house hacker hunting team, the revamp was necessary to bring clarity to security researchers both inside the company and externally.

• Google now tracks more than 5,000 "activity clusters" in several countries, according to John Hultquist, chief analyst at Google Threat Intelligence Group.

But what is the point of naming hacking groups? It's not just an academic exercise, Huntley explained. The goal is to have a baseline understanding of who is attacking who, and how they are attacking them.

That way organizations can recognize threats more quickly, prepare against them, ideally stop them, or at least investigate incidents more promptly.

Knowing how the North Korean government hackers known as the Lazarus Group behaves, what their goals usually are, and who they work for, gives defenders a starting point in dealing with these hackers.

However, tracking state-sponsored hackers, while challenging, is easier than tracking cybercriminal groups and hackers-for-hire, Huntley explained. The government hackers tend to have more consistent targets and activities, while cybercriminal groups have members that come and go, sometimes splinter, and otherwise are more amorphous.

• A common criticism whenever a new naming system gets announced is: Why don't all companies and organizations just use the same codenames? While that seems like an easy question to answer, the reality is that every company has a slightly different view of every group, based on their own sets of data and telemetry.

Huntley said this is an inescapable reality that can't be avoided just by sharing more information among companies and groups of researchers.

No one has perfect visibility, he said. We are building our model and our best understanding, but we will never know everything about what's going on.