Google's top hacker hunter explains why hacking groups get codenames
TechCrunch
β’Sat, 08 Aug 2026 15:00:00 +0000
π° What Happened
Google revamped its naming system for hacking groups, moving away from the old Mandiant-era 'APT' number scheme to memorable random first names paired with a country-indicating second word (Castle for China, Ion for Iran, Neptune for North Korea, Relic for Russia). Google Threat Intelligence Group CTO Shane Huntley explained the change was needed to bring clarity given the growing number of tracked groups.
π The Backstory
The cybersecurity industry has assigned codenames to hacking groups for more than a decade, but every company named them differently, creating confusion. Mandiant pioneered the approach and its APT-style numbering was widely adopted before Google, which acquired Mandiant, overhauled the system.
π― Why It Matters
Consistent, memorable naming helps security researchers, journalists, governments and the public track and understand cyber threats. It matters because clearer identification of state-linked hackers makes reporting on breaches and digital attacks more understandable for everyone.
Google revamped its naming system for hacking groups, moving away from the old Mandiant-era 'APT' number scheme to memorable random first names paired with a country-indicating second word (Castle for China, Ion for Iran, Neptune for North Korea, Relic for Russia). Google Threat Intelligence Group CTO Shane Huntley explained the change was needed to bring clarity given the growing number of tracked groups.
The cybersecurity industry has assigned codenames to hacking groups for more than a decade, but every company named them differently, creating confusion. Mandiant pioneered the approach and its APT-style numbering was widely adopted before Google, which acquired Mandiant, overhauled the system.
Consistent, memorable naming helps security researchers, journalists, governments and the public track and understand cyber threats. It matters because clearer identification of state-linked hackers makes reporting on breaches and digital attacks more understandable for everyone.