Why Hackers Get Codenames: Insights from Google’s Top Threat Hunter

In a recent shift, Google has updated its approach to naming and referring to hacking groups. TechCrunch sat down with one of the world’s foremost experts on hacker tracking to uncover the reasoning behind these codenames. The expert, who leads Google’s threat intelligence efforts, revealed that codenames serve as more than just catchy labels—they help researchers communicate efficiently, track evolving tactics, and avoid confusion when multiple groups share similar techniques. The new naming system aims to be more descriptive and less arbitrary, reflecting the group’s behavior, origin, or target sector. This change also helps the broader cybersecurity community align on a common language, improving collaboration and threat attribution. The expert emphasized that while codenames are useful, they are not definitive proof of identity, as groups often mimic others to mislead defenders. The interview highlights the delicate balance between clarity and accuracy in the ever-evolving landscape of cyber threats.