# Google Introduces New Naming System for Cyber Attack Groups Google's top hacker hunter explains the codenaming of cyber attack groups. - **Source:** [TechCrunch](https://techcrunch.com) - **Published:** 2026-08-08 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/6e50e47f-f7e2-41fa-b5f4-65c657c2c8bb ## Codenaming Cyber Attack Groups The cybersecurity industry has been assigning codenames to different hacker groups for over a decade. Some groups, like Fancy Bear, have crossed into the mainstream due to their prominent hacks and memorable names. Others are known only within the cybersecurity industry. The fact that every company names hacker groups differently makes tracking them difficult. ## Google's New Naming System Last month, Google launched a new naming system for hacker groups. The old system used numbers like APT1 and APT41. In the new system, each hacker group will have a memorable first name and a second word indicating the country of origin. For example, Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia. ## The Purpose of Naming Shane Huntley, CTO of Google Threat Intelligence Group, says the purpose of naming is to understand who is attacking whom and how they are attacking. This allows organizations to recognize threats more quickly, prepare against them, and investigate incidents more promptly. Naming hackers and tracking them consistently plays a critical role in this process. ## Tracking State-Sponsored Hackers Tracking state-sponsored hackers is easier than tracking cybercriminal groups. Government hackers have more consistent targets and activities, while cybercriminal group members come and go and sometimes splinter. Hacker-for-hire groups and spyware makers have many customers in different parts of the world, making them slightly harder to track. ## Challenges of Naming Systems A common criticism when a new naming system is announced is why don't all companies and organizations use the same codenames? Each company has a slightly different view of each group based on its own data and telemetry. Huntley says this is an inescapable reality that cannot be solved by sharing more information. ## Google's Tracking Efforts Google currently tracks over 5,000 'activity clusters' in several countries. Shane Huntley says very few developed nations do not have their own cyber capabilities and hacker groups. These tracking efforts are critical for understanding threats and developing defense strategies. ## Understanding Hacker Behavior Knowing a hacker group's behavior, goals, and past activities provides defenders with a starting point. For example, understanding the behavior of the Lazarus Group, supported by the North Korean government, helps in dealing with these hackers. ## The Importance of Naming Naming hackers and tracking them consistently is a critical step in cybersecurity. It enables faster threat recognition, preparation, and incident investigation. Google's new naming system aims to make this process clearer and more understandable. ## Sources covering this story - https://techcrunch.com/2026/08/08/googles-top-hacker-hunter-explains-why-hacking-groups-get-codenames/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._