Post

I still don't fully understand cyber company code names. If you're tracking a Russian group that you name explicitly as Russian, why do you need a cryptonym that means Russia? Isn't this just an extra layer of obfuscation? Only thing I can make out is that coming up with code names is kick ass fun

I understand everything about visibility, confidence, difficulty of attribution, yada yada yada. If I say in a blog that "borscht" = Russia, can't we just cut out the borscht bit entirely? Wouldn't that make this whole thing simpler? Again, I come back to: Naming a military agency borscht seems fun

Okay, fun aside, the answer is more likely that it's a marketing function. You own the name "borscht," whenever someone mentions the vaunted threat actor SPICY BORSCHT, someone relevant with the power of the purse may think of your CTI firm.

There’s one other advantage, in that “Spicy Borscht = Russian state hackers” is just the best assessment. If that assessment changes, you can still call the group Spicy Borscht, you don’t have to go do a correction in all the work products referencing Spicy Borscht.

This is interesting but I have to push back and ask for your thoughts. If I have a blog post pinned to the top of my CTI firm's blog saying definitively that BORSCHT = Russia, can I actually keep that name in my work products if the attribution changes? In that case, the name is the attribution

Ideally you’d keep the number of work products that say “Spicy Borscht = Russia” to a bare minimum. Yes, these would all have to be corrected. But the ones that say “an attack on IOT aquarium feeders was assessed to be performed by Spicy Borscht based on such and such” would not.