Podcast Summary: Hacking Humans
Episode: Adversary Group Naming
Host: N2K Networks
Release Date: July 8, 2025

Introduction to Adversary Group Naming

In this episode of Hacking Humans, hosted by N2K Networks, the focus centers on the practice of adversary group naming within the realm of cyber threat intelligence. Adversary group naming involves assigning specific labels—often arbitrary words or phrases—to collections of hacker activities, serving as shorthand for discussing complex threat behaviors.

Historical Context and Origins

The concept of naming adversary groups is traced back to 1998, a pivotal year when the United States government pioneered the practice. During heightened tensions between the U.S. and Iraq, a series of cyber-attacks were initially attributed to Iraq. However, investigations revealed that the perpetrators were actually teenagers from Cloverdale, California. To categorize these activities, the U.S. government coined the codename Solar Sunrise—referencing the exploitation of vulnerabilities in the Sun Solaris operating system ([00:14]).

Shortly after, another significant cyber incident targeting the Pentagon, NASA, and the Department of Energy was labeled Moonlight Maze. Although initially attributed to Russia, later evidence suggested otherwise. These early instances set the precedent for assigning codenames to cyber threats, a practice that has since become standard in the industry.

Evolution of Naming Conventions

Over the subsequent decade, adversary group naming evolved significantly, influenced by several key developments:

1. Lockheed Martin's White Paper: Intelligence Driven Computer Network Defense, Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains introduced structured methodologies for understanding and categorizing cyber threats.

2. Mandiant's APT1: Published in 2010, this white paper exposed one of China's cyber espionage units, highlighting the importance of detailed threat attribution.

3. MITRE's Attack Framework: Released in 2013, this framework provided a comprehensive structure for mapping and analyzing cyber attack methodologies.

These milestones shifted the focus from merely assigning catchy codenames to developing systematic labels based on observed attack sequences within the intrusion kill chain. For example, instead of detailing specific malware or exploit kits used, analysts could reference an attack sequence like Wicked Panda, streamlining communication and analysis.

Vendor-Specific Naming Schemes

As the practice standardized, various security vendors introduced their own naming conventions, contributing to a complex landscape:

• Mandiant: Utilizes "APT" followed by numbers (e.g., APT1, APT3, APT5).
• CrowdStrike: Employs animal names to signify different threat actors, such as bears for Russia and kittens for Iran.
• Microsoft: Draws from elements of the periodic table.

This diversity in naming conventions has led to significant confusion within the cybersecurity community. For instance, the same adversary group might be referred to by multiple names across different platforms, such as The Lazarus Group, APT37, and Hidden Cobra all representing the same entity.

The Confusion and Challenges

The proliferation of varied naming schemes poses challenges for cybersecurity professionals. Without a unified naming standard, tracking and responding to threats become more complicated. Additionally, many vendor-based names include nation-state attributions that are often circumstantial. As one expert noted:

“Unless you were paying very close attention, the average security professional wouldn't know that The Lazarus group, Apt 37, Hidden Cobra, and about 19 other colorful names all refer to the same adversary group activity.” ([Timestamp: Not Provided])

This fragmentation necessitates a more streamlined approach to naming, focusing on attack sequences rather than the tools or presumed origin of the threat actors.

Best Practices for Naming Adversary Groups

To mitigate confusion, the episode offers two key pieces of advice for those involved in naming adversary groups:

1. Avoid Tool-Based Names: Naming a group after the tools they use (e.g., Bumblebee Group for those using Bumblebee malware) can lead to misunderstandings and complicate threat tracking.

2. Choose Readable and Memorable Names: Opt for names that are easy to read and spell, enhancing clarity and communication. For example, using Wicked Panda instead of Winnti simplifies references and improves overall comprehension.

Notable References and Insights

The episode references Thomas Rid, author of Rise of the Machine, who discussed the Moonlight Maze incident at the Kaspersky Cyber Conference in 2017. His presentation underscored the complexities of attributing cyber attacks to nation-states, especially when initial evidence may later prove inaccurate. Rid emphasized the importance of relying on concrete attack sequences rather than speculative geopolitical attributions.

Conclusion

Adversary group naming is a critical component of cyber threat intelligence, enabling analysts to effectively communicate and strategize against persistent threats. However, the current landscape of varied naming conventions presents significant challenges, including confusion and misattribution. By adopting standardized, sequence-based naming practices and avoiding tool-centric labels, the cybersecurity community can enhance clarity and improve collective defense mechanisms.

This episode was produced by Naila Genoe, with executive production by Peter Kilpe. Editing was handled by John Pettrick and Rick Howard, while Elliot Peltzman crafted the mix, sound design, and original music.