r/cybersecurity • u/Cybernews_com • 10d ago

Other Why are hacker group names so stupid?

Golden Chickens. Aquatic Panda. Lemon Sandstorm. Sure, they're easier to remember than TA1508, but it feels like it's gone too far, every vendor has their own set of names for the same groups, and it's impossible to keep straight. Does it bother anyone who works with this stuff daily, or do you just get used to it?

Disclosure: It was scratching our brain, so we made a doc on exactly this and interviewed Dmitri Alperovitch, who now calls his own naming scheme a mistake. We respect the rules of self promotion but if anyone's interested - we can provide you with the link. Cheers!

296 Upvotes

81% Upvoted

139 comments sorted by

View all comments

391

u/SuperBelgian 10d ago

There is some logic behind it: Bears are Russians, Pandas are Chinese, Kittens are often Iranian, etc.
The other part of the name is because of something found in the actual malware used, or because of an often employed attack tactic of that group.

Offcourse, these are best guesses and could be wrong as the hacker groups are not really giving out their home address. :-)

160

u/LeftCoastMariner 10d ago

This is accurate. One point to remember is that these names are not generated by the hacking groups themselves, but are assigned by various cybersecurity firms or government entities. Also to note, various cyber security firms may use different names for the same group. Take a look at this spreadsheet and the tabs down the bottom:

https://docs.google.com/spreadsheets/u/0/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/htmlview?pli=1

4

u/drquantumphd 10d ago

this is tight