Google Changes Hacker Group Naming System: What It Means for Cybersecurity

Google has introduced an updated naming system for hacker groups, abandoning the previous APT numbering scheme used by Mandiant prior to its acquisition. Now, each group receives a random first name and a second word whose initial letter indicates its country of origin. For example, Chinese groups will be labeled with 'Castle,' Iranian groups with 'Ion,' North Korean groups with 'Neptune,' and Russian groups with 'Relic.'

According to Shane Huntley, head of Google’s Threat Intelligence Group, the changes aim to simplify cybersecurity professionals' work. Previously, the industry faced data fragmentation issues, as different companies assigned varying names to the same groups, complicating information sharing. Google tracks over 5,000 'activity clusters' across dozens of countries, and the new system should help structure this data more effectively.

However, tracking hacker groups remains challenging even with a unified system. State-sponsored cyber groups, such as North Korea’s Lazarus Group, operate more predictably than criminal or mercenary hackers, who frequently change their composition and objectives. Huntley emphasized that no single company possesses a complete threat picture, making collaboration among researchers critically important.

The new Google system merges data from two teams: Threat Analysis Group and Mandiant. This should reduce competing naming schemes but won’t eliminate the problem entirely. Experts note that without standardized industry data, a unified naming system is unlikely to emerge in the near future.