Google's hacker naming system explained by Shane Huntley

Shane Huntley, CTO of Google Threat Intelligence Group, explained that the revamp is crucial for providing clarity to both internal and external security researchers. He noted that in the early 2010s, when naming began, the number of threat groups was not anticipated to be as large as it is today. Google now tracks over 5,000 'activity clusters' across various countries, highlighting the widespread nature of cyber capabilities.

Huntley emphasized that naming hacking groups is not merely an academic exercise. It serves to establish a baseline understanding of attacker motivations and methods, enabling organizations to recognize threats more quickly, prepare defenses, and investigate incidents more efficiently. Knowing an actor's behavior, past actions, and affiliations, such as those of the North Korean Lazarus Group, is critical for effective incident response and threat mitigation.

He further elaborated that tracking state-sponsored hackers is generally more manageable than tracking cybercriminal or hacker-for-hire groups, which tend to be more amorphous with members frequently joining and leaving. The diverse customer base of hacker-for-hire entities also complicates tracking.

A common criticism is the lack of a universal naming system. Huntley acknowledged that this is an inescapable reality, as each company's perspective on a group is shaped by its unique data and telemetry, and no single entity possesses perfect visibility. By unifying the naming schemes of Google's former Threat Analysis Group and Mandiant, Google aims to reduce the number of systems researchers need to track.