Post

I still don't fully understand cyber company code names. If you're tracking a Russian group that you name explicitly as Russian, why do you need a cryptonym that means Russia? Isn't this just an extra layer of obfuscation? Only thing I can make out is that coming up with code names is kick ass fun

I understand everything about visibility, confidence, difficulty of attribution, yada yada yada. If I say in a blog that "borscht" = Russia, can't we just cut out the borscht bit entirely? Wouldn't that make this whole thing simpler? Again, I come back to: Naming a military agency borscht seems fun

Okay, fun aside, the answer is more likely that it's a marketing function. You own the name "borscht," whenever someone mentions the vaunted threat actor SPICY BORSCHT, someone relevant with the power of the purse may think of your CTI firm.