Post

I still don't fully understand cyber company code names. If you're tracking a Russian group that you name explicitly as Russian, why do you need a cryptonym that means Russia? Isn't this just an extra layer of obfuscation? Only thing I can make out is that coming up with code names is kick ass fun

I understand everything about visibility, confidence, difficulty of attribution, yada yada yada. If I say in a blog that "borscht" = Russia, can't we just cut out the borscht bit entirely? Wouldn't that make this whole thing simpler? Again, I come back to: Naming a military agency borscht seems fun

Okay, fun aside, the answer is more likely that it's a marketing function. You own the name "borscht," whenever someone mentions the vaunted threat actor SPICY BORSCHT, someone relevant with the power of the purse may think of your CTI firm.

There’s one other advantage, in that “Spicy Borscht = Russian state hackers” is just the best assessment. If that assessment changes, you can still call the group Spicy Borscht, you don’t have to go do a correction in all the work products referencing Spicy Borscht.

Ideally you’d keep the number of work products that say “Spicy Borscht = Russia” to a bare minimum. Yes, these would all have to be corrected. But the ones that say “an attack on IOT aquarium feeders was assessed to be performed by Spicy Borscht based on such and such” would not.