Google Changes How It Names Hacking Groups

Google has updated its policy for naming and referring to hacking groups, moving away from the ad‑hoc codenames that had previously been used in security advisories. The change, announced in a recent blog post, explains that the new system will standardise references across the company’s threat‑intel ecosystem, ensuring consistency in incident reports and public communications. The update follows a broader industry trend toward more systematic threat‑actor taxonomy, which helps analysts and customers correlate attacks more efficiently.

TechCrunch spoke with Dr. Elena Morales, a leading researcher in cyber‑threat attribution, to explore why organisations still assign codenames to malicious actors. Morales explained that codenames serve several practical purposes: they simplify internal communication, protect sensitive intelligence by avoiding the use of real names, and help stakeholders quickly identify recurring patterns without revealing attribution details that could be exploited. She noted that while the new Google framework retains the benefits of codenames, it also incorporates a structured naming convention that aligns with global threat‑intel standards, improving cross‑organization collaboration.

The shift reflects a growing emphasis on clarity and interoperability in cybersecurity reporting. By adopting a more uniform naming scheme, Google aims to reduce confusion among security teams and enhance the accuracy of threat intelligence sharing. The move is expected to streamline incident response processes and support the broader cybersecurity community in tracking and mitigating emerging threats.