Behind every major cyberattack that makes headlines, there is usually a hacking group operating in the shadows. But how do cybersecurity professionals keep track of hundreds of these groups operating across dozens of countries? The answer lies in a system of codenames — and it matters far more than most people realize.
A Naming System Built for a More Complex Threat Landscape
For over a decade, the cybersecurity industry has been assigning codenames to hacking groups. Names like Fancy Bear — the Russian group linked to high-profile election interference — have broken into mainstream conversation. But thousands of other groups remain known only to specialists. The problem has never been secrecy; it has been coordination.
Google recently overhauled how it names the hacking groups it tracks, replacing the old APT numbering system inherited from Mandiant — a once-independent security firm now operating under Google’s umbrella — with a more intuitive structure. Going forward, each group receives a memorable first name paired with a second word whose initial letter signals national origin: Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia. It is a small but meaningful change designed to reduce confusion among the thousands of researchers who rely on this information daily.
Google’s threat intelligence team now monitors more than 5,000 distinct activity clusters across multiple countries, a scale that would have been unimaginable when these naming conventions first emerged in the early 2010s. The sheer volume of groups underscores how professionalized and state-backed cyber operations have become globally.
Naming Is Not Just Bureaucracy — It Is a Defense Strategy
It would be easy to dismiss the naming of hacking groups as an academic exercise. It is anything but. When organizations understand which group is targeting them, they gain critical advantages: they know the group’s typical methods, their historical targets, and their broader geopolitical motivations.
Consider the Lazarus Group, the North Korean state-sponsored collective responsible for attacks ranging from the Sony Pictures hack in 2014 to billions of dollars in cryptocurrency theft. Security teams that recognize Lazarus Group signatures in an intrusion can immediately apply known behavioral profiles, dramatically accelerating incident response. Without consistent naming and tracking, each attack would require rebuilding that understanding from scratch — a costly and dangerous delay.
Tracking cybercriminal groups and mercenary hackers-for-hire is considerably harder. Unlike state-sponsored groups, which maintain consistent targets and methods, criminal organizations shift membership, splinter, and operate across jurisdictions with no central accountability.
What This Means for Businesses Investing in Cybersecurity Tools
For companies evaluating cybersecurity solutions, this development carries direct implications. Threat intelligence platforms that integrate standardized naming conventions offer faster threat identification and cleaner reporting — measurable advantages when procurement teams are comparing vendors. As Google unifies its naming infrastructure, expect competing platforms to follow suit, raising the baseline quality of threat intelligence products available to enterprise buyers. Organizations serious about cyber resilience should prioritize tools built on structured, consistently updated threat actor databases when making their next security investment.
