Google’s Cybersecurity Team Explains Why Hacking Groups Get Codenames

Google has revamped its naming system for hacking groups, moving away from numerical codes like APT1 or APT41 to more memorable names paired with country-specific suffixes. For example, 'Castle' for China, 'Ion' for Iran, 'Neptune' for North Korea, and 'Relic' for Russia.

The Challenge of Tracking Cyber Threat Groups

Shane Huntley, chief technology officer of Google Threat Intelligence Group (GTIG), noted that when companies began publishing reports on cyberattacks in the early 2010s, they never expected to track over 5,000 'activity clusters' today. Huntley added that 'nearly every developed nation has its own cyber capabilities and hacking groups.'

The Purpose of Codenames

Huntley explained that the goal of naming hacking groups is to understand 'who is attacking whom, how they are attacking, and how to defend against them.' For instance, knowing the behavior of North Korea’s Lazarus Group provides defenders with a critical starting point.

State-Sponsored Hackers vs. Cybercriminals

Huntley noted that tracking state-sponsored hackers is easier than cybercriminal groups, as the former tend to have more consistent targets and activities. However, cybercriminals are more fluid, with members coming and going and multiple customers worldwide.

Cyber threats are no longer just an academic exercise; companies and governments are using this naming system to respond faster and better protect against these groups. The unified approach reduces confusion and improves threat intelligence.