Post

I still don't fully understand cyber company code names. If you're tracking a Russian group that you name explicitly as Russian, why do you need a cryptonym that means Russia? Isn't this just an extra layer of obfuscation? Only thing I can make out is that coming up with code names is kick ass fun

Okay, fun aside, the answer is more likely that it's a marketing function. You own the name "borscht," whenever someone mentions the vaunted threat actor SPICY BORSCHT, someone relevant with the power of the purse may think of your CTI firm.

There’s one other advantage, in that “Spicy Borscht = Russian state hackers” is just the best assessment. If that assessment changes, you can still call the group Spicy Borscht, you don’t have to go do a correction in all the work products referencing Spicy Borscht.

This is interesting but I have to push back and ask for your thoughts. If I have a blog post pinned to the top of my CTI firm's blog saying definitively that BORSCHT = Russia, can I actually keep that name in my work products if the attribution changes? In that case, the name is the attribution