Hacker groups should get uniform names

Leading companies in the security sector – Microsoft, Crowdstrike, Palo Alto Networks and Google – have announced an unusual alliance: A joint body should ensure a uniform naming for hacker groups.

Eliminate confusion

In particular, the state -supported groups, which have been active for many years and are observed by several expert groups, have always had several names. Depending on who wrote a report on current incidents, the same perpetrators are called differently, which always leads to ambiguities. This should now change the joint initiative, reports the news agency Reuters. And it’s not just about ensuring more clarity in public. “We believe that this will significantly improve our collective reaction and defense against these threats,” said Vasu Jakkal, responsible for security at Microsoft.

The history of the group’s pointed names goes back to a time when security researchers began to give cryptic names such as “apt1” or “TA453”. Over the years, the names have become more and more unusual: “Cozy Bear”, “Kryptonite Panda” or “Earth Lamia” are just a few examples of the wild growth that prevails today.

A particularly chaotic example of this provided a report by the US government from 2016 on Russian influence on the presidential election. In the document, 48 different names for hacker groups and malware were listed – including terms such as “Sofacy”, “Chopstick” and “Tsar Team”. Even for experts, it was hardly possible to keep an overview.

First success

With the planned glossary, the companies involved now want to take a first step towards standardization. Palo Alto Networks speaks of a milestone, while other voices are more skeptical. The analyst Juan-Andres Guerrero-Saade from Sentinelone warned that many companies did not want to share their information-without this change, the initiative remains a well-intentioned but ineffective PR attempt.

However, a small success has already been recorded: The collaboration has recognized that Microsoft’s “Salt Typhoon” is the same group as crowdstrikes “Operator Panda”. Such findings should be possible much faster in the future – thanks to clear, common terms.