Home / Technology / Google Rebrands Hacking Groups With New Naming Scheme
Google Rebrands Hacking Groups With New Naming Scheme
30 Jul
Summary
- Google is replacing old identifiers with two-word cryptonyms.
- Second word denotes attribution like China, Iran, or Russia.
- New scheme aims for intuitive tracking but adds complexity.
Google Threat Intelligence Group is standardizing its naming conventions for tracked cyber threats by adopting a new cryptonym system. This initiative replaces the inherited identifiers from Mandiant and its own Threat Analysis Group with distinct, two-word names.
The new scheme pairs a memorable first word with a second word that signifies attribution or motive. For instance, groups linked to China will use 'CASTLE,' Iran 'ION,' North Korea 'NEPTUNE,' Russia 'RELIC,' and criminal crews 'COMET.'
This strategic shift aims to offer defenders more intuitive insights into the origins and motivations of cyber actors, moving away from sequential identifiers. While Russia-linked 'Sandworm Relic' is an early example, the industry already faces multiple naming conventions.
The move follows Google's 2022 acquisition of Mandiant, merging two previously independent tracking systems. Although Google previously agreed to participate in a shared alias mapping effort, this new system introduces another layer for defenders to learn and navigate.
