Malware, campaigns, and actor naming
What's in a name? In the cybersecurity community, a lot. While there is seemingly an endless number of bears, lotuses, spiders, and octopi, these names aren't arbitrary. Most often, these names that are employed by companies across the globe are nicknames associated with clustered attributes about the groups behind malicious activities.
The act of naming
The act of naming threat actors is done by vendors throughout the security community, such as FireEye, Dell Secureworks, Palo Alto Networks, Crowdstrike, or Symantec. Some companies use animals or insects, while others use numbers, but one thing is for certain: it's confusing.
Names are often derived based on technical and operational groups of activity, such as a grouping of malicious macro-embedded decoy documents with the same author and payload. Operational groupings can occur when there is a similarity in operational work, such as sharing a C2 infrastructure among a...
