Why Google Assigns Codenames to Hacker Groups

Google has recently changed its approach to tracking and naming hacker groups. In light of this, TechCrunch interviewed global experts in hacker tracking to explore why security companies assign codenames to hacker groups.

In the world of cybersecurity, it has become standard practice to classify attackers based on 'who' and 'for what purpose' they are operating, and to manage them using unique codenames. This system helps investigators organize and share information when multiple attacks may be linked to the same organization or nation-state. Without codenames, different companies and research institutions would track the same group separately, making it difficult to share threat intelligence.

As Google updates its approach to naming hacker groups, the framework for information organization within the industry is shifting. The company maintains a specialized division for tracking and analyzing hacker groups, and this change is part of its ongoing efforts. Leading global experts in hacker tracking explained to TechCrunch the specific criteria behind the new naming methodology.

Codenames serve a practical purpose. Even if an attack group targets multiple countries and employs different techniques, aggregating information under the same codename allows researchers and companies to grasp the bigger picture more easily. Additionally, codenames function as neutral 'labels' to avoid the diplomatic and legal risks of publicly associating group names directly with nation-states.

Meanwhile, the variation in naming conventions across companies has long been recognized as a challenge. When the same group is called 'Group X' by Company A and 'Cluster Y' by Company B, confusion can easily arise in information-sharing forums. Google's change in methodology can be understood as an attempt to improve industry-wide consistency and alignment.

The methods used for naming and classifying hacker groups directly impact how government agencies and research institutions share and respond to threat intelligence, not just security companies. Google's review of its naming methodology is a noteworthy development from the perspective of industry-wide standardization of information management. Going forward, how other security companies and organizations respond to Google's new approach will serve as an indicator of the maturity of the industry's information-sharing framework.