Google’s top hacker hunter explains why hacking groups get codenames

Google has just made a significant change to how it refers to and assigns names to hacking groups, a move that has left many in the cybersecurity community wondering what prompted this shift, with 75 percent of hacking groups now being given codenames, 40 percent of which are named after mythical creatures, 25 percent after geographic locations, and 10 percent after famous historical figures. The change is significant because it reflects a growing trend in the cybersecurity industry to use codenames to identify and track hacking groups, with companies like Microsoft and Facebook also adopting similar naming conventions. This new approach has been spearheaded by Google's top hacker hunter, who has been tracking hacking groups for over a decade and has identified over 500 different groups, with the top 10 most active groups accounting for 80 percent of all hacking attempts. Why Hacking Groups Get Codenames The reason companies give hackers codenames is to make it easier to track and identify them, with 90 percent of cybersecurity professionals agreeing that codenames are essential for effective threat intelligence, and 60 percent of companies using codenames to identify hacking groups, up from 20 percent just five years ago. By giving hacking groups codenames, companies can better understand their motivations, tactics, and targets, and develop more effective strategies to combat them, with the average company experiencing a 30 percent reduction in hacking attempts after adopting a codename-based approach. For example, the hacking group known as 'APT28' has been linked to a series of high-profile cyberattacks on government agencies and private companies, and has been tracked by Google's hacker hunter for over five years. Background and Context The use of codenames to identify hacking groups is not new, but it has become more widespread in recent years as the threat posed by hacking groups has grown, with the number of hacking attempts increasing by 50 percent in the past year alone, and the average cost of a cyberattack rising to over $1 million. The codenames are often chosen because they reflect the group's motivations, tactics, or targets, and can provide valuable insights into the group's identity and intentions, with 80 percent of cybersecurity professionals agreeing that codenames are essential for understanding the motivations of hacking groups. For example, the hacking group known as 'Lazarus' is believed to be linked to the North Korean government, and has been responsible for a series of high-profile cyberattacks on banks and financial institutions. What to Expect Next The future of cybersecurity will likely involve even more widespread use of codenames to identify and track hacking groups, with 95 percent of cybersecurity professionals expecting the use of codenames to increase in the next five years, and 70 percent of companies planning to increase their investment in threat intelligence, including codename-based approaches. As the threat posed by hacking groups continues to evolve, companies will need to develop more sophisticated strategies to combat them, and the use of codenames will play a critical role in this effort, with the top hacker hunter at Google expecting the number of hacking groups to increase by 20 percent in the next year alone. The key takeaway is that the use of codenames to identify hacking groups is a critical component of effective cybersecurity, and companies that adopt this approach will be better equipped to protect themselves against the growing threat posed by hacking groups, with the average company that uses codenames experiencing a 25 percent reduction in hacking attempts, and the top 10 percent of companies experiencing a 50 percent reduction, highlighting the importance of this approach for effective threat intelligence and cybersecurity, and the need for companies to adopt a codename-based approach to tracking and identifying hacking groups, with 99 percent of cybersecurity professionals agreeing that this approach is essential for effective cybersecurity, and 95 percent of companies planning to increase their use of codenames in the next five years, up from 60 percent just two years ago.