Google Changes Its Cybersecurity Group Naming System

For more than a decade, various hacking groups in the cybersecurity field have been assigned code names. Some groups, such as "Fancy Bear," have even become well known in the media because of their high-profile attacks and memorable names. Others are known only to a narrow circle of specialists. According to ixbt.com, even industry experts often cannot remember all the names. TechCrunch.com reports .

One of the main reasons is that each company gives cybercriminal groups different names of its own. As a result, security specialists, government officials, politicians, journalists and the general public have difficulty understanding who is who. That is why there have been many attempts to create unified databases to eliminate this confusion.

The Meaning of the New Naming System

Last month, Google fundamentally updated its system for naming cyberattack groups. The numerical designations previously used by Mandiant, the security firm owned by Google, such as APT1 and APT41, are now a thing of the past. In fact, Mandiant was one of the first organizations to introduce such a naming scheme.

Google's new system is much simpler and easier to understand. Under it, each hacking group receives a memorable random first name and a second word indicating its country of origin:

• China — Castle
• Iran — Ion
• North Korea — Neptune
• Russia — Relic

Expert Commentary and Risk Assessment

According to Shane Huntley, technology director of the Google Threat Intelligence Group (G_T_I_G), the change was necessary to provide clarity for both the company's internal teams and external security researchers. When companies began publishing reports on cyberattacks and the hackers behind them in the early 2010s, experts did not expect the emergence of as many threat groups as there are today.

According to John Hultquist, chief analyst at G_T_I_G, Google currently tracks more than 5,000 activity clusters across several countries. Shane Huntley noted that there are now almost no developed countries without their own cyber capabilities and hacking groups.

But what is the main purpose of assigning special names to hacking groups? Huntley explained that this is not merely an academic exercise. The primary goal is to achieve a basic but accurate understanding of who is attacking whom and what methods they are using.

This approach enables organizations to identify threats faster, prepare for them in advance, prevent them whenever possible, or quickly investigate incidents that have occurred. According to the expert, all of this can be achieved only by naming hackers accurately and monitoring them consistently.