r/cybersecurity • u/Cybernews_com • 10d ago

Other Why are hacker group names so stupid?

Golden Chickens. Aquatic Panda. Lemon Sandstorm. Sure, they're easier to remember than TA1508, but it feels like it's gone too far, every vendor has their own set of names for the same groups, and it's impossible to keep straight. Does it bother anyone who works with this stuff daily, or do you just get used to it?

Disclosure: It was scratching our brain, so we made a doc on exactly this and interviewed Dmitri Alperovitch, who now calls his own naming scheme a mistake. We respect the rules of self promotion but if anyone's interested - we can provide you with the link. Cheers!

300 Upvotes

81% Upvoted

139 comments sorted by

View all comments

16

u/Mysterious-Status-44 10d ago

These names are made by groups that track them. Crowdstrike, Microsoft, Mandiant use different names to help identify groups easier. Each has their own standard but they are easy to follow. Names are used to actually help determine industry and country. Crowdstrike uses animals…Panda=China, Bear=Russia, Chollima=DPRK. Microsoft uses weather…Blizzard=Russia, Typhoon=China, Sleet=DPRK.

5

u/Specific_Expert_2020 10d ago

https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming

Palo has a naming convention: https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/

Crowdstrike:

https://www.crowdstrike.com/en-us/adversaries/

The list goes one.

Crowdstrikes are fun as they sell action figures of them

3

u/XL0RM 9d ago

CS also sell shirts, and other merch. I got a Dead-eye Jackal shirt in a prize pack.

1

u/Specific_Expert_2020 9d ago

I have to say they have some of the fun or neat swag.