Adversary Group Naming: A Cyber Threat Intelligence Best Practice

The Practice of Adversary Group Naming

• 💡 Adversary group naming is a cyber threat intelligence best practice involving the assignment of arbitrary labels to collections of hacker activity across the intrusion kill chain.
• 🎯 This practice helps to categorize and discuss various cyber threat actor campaigns in a concise manner.

Historical Origins of Naming

• 🚀 The US government pioneered this practice in 1998 with the code name Solar Sunrise for a series of hacks, initially attributed to Iraq but later found to be the work of teenagers.
• 📌 Another early example is Moonlight Maze, a separate attack targeting US government entities, which was also given a code name.
• ⚠️ These early instances established a precedent for using distinct names to classify and track cyber intrusions.

Evolution of Naming Conventions

• 🔑 The practice evolved significantly around 2010-2013 with the publication of key white papers and the release of the MITRE ATT&CK framework.
• 🧩 Naming shifted from cool code names to labels associated with observed attack sequences and the intrusion kill chain.
• 💬 This allowed analysts to use shorthand, like referring to an attack sequence as "Wicked Panda" instead of detailing specific malware and exploit kits.

Challenges and Vendor Naming Schemes

• 🤯 Security vendors developed their own naming schemes, such as Mandiant's APT numbers, CrowdStrike's animal associations, and Microsoft's periodic table elements, leading to significant confusion and overlap.
• 🔍 Many different names, like Lazarus Group, APT37, and Hidden Cobra, can refer to the same adversary group.
• ⚠️ Nation-state attribution by security vendors is often circumstantial and should be approached with caution; focusing on the attack sequence is often more practical for developing defenses.

Best Practices for Naming

• 🛠️ When naming adversary groups, avoid using the tools they employ, as this can cause confusion (e.g., naming a group after the "Bumblebee malware").
• ✅ Choose easy-to-read and easy-to-spell names to enhance understandability, such as "Wicked Panda" over more complex or obscure designations.