Sometimes I think my cybersecurity colleagues believe they are living in a spy novel. I mean, we are all guilty of trying to make our day jobs sound more interesting or trying to make them sound more ‘sexy’, but this industry in particular takes the cake. Even the name “cybersecurity” is like “oooh, I work in a William Gibson novel!” Though we can’t fault someone trying to make their job sound better than “security guard at an online shopping mall”.
Names for cybercriminals
What I don’t understand is why our industry gives sexy names to the worst criminals on the internet – for example, state-sponsored Advanced Persistent Threat (APT) gangs. In terms of the damage they do, these are the worst types of cybercriminals. They undermine elections, steal medical research, violate privacy at an unimaginable scale, and vandalise vital parts of countries that they disagree with. Basically, they are a bunch of jerks who ruin the internet for the rest of us but the names we give them make them sound like they are Robin Hood! Here are some of the main groups and their commonly used names, so you can see what I mean:
- Fancy bear
- Cozy bear
- Lazarus group
- Red Apollo
- Nomadic octopus
- Mustang Panda
- Pioneer Kitten
Why does the industry insist on giving them sexy names that give them an undeserved allure? APT groups are named by analyst firms, and apparently there is a bit of a game in terms of having the most catchy name (if the industry uses your name then you’ve somehow “won the interwebs”?). But that does not explain why they do not try for catchy names that aren’t so positive! Every group has also been given a boring name (e.g. APT28) – however, everyone in the industry still uses the sexy name!
What is going on here? Personally, I think it is because it makes people in the cybersecurity industry feel better, it raises their status. They look far cooler if they make it sound like they are going toe-to-toe with an organisation like SPECTRE, rather than the reality that they are just duking it out with 16-year-old script kiddies and glorified civil servants. This feeds their sense of self-importance. It makes their job sound more interesting. And then I also think a lot of them secretly sympathise with the hackers – maybe they want to be hackers, some of them clearly were hackers in a past life.
What we should really call cybercriminals
What I suggest is instead we give these groups insulting names that show them the contempt that they so richly deserve. After all, when you think about it these people aren’t James Bond or Nancy Wake. They aren’t hacking from casinos in a tuxedo. They are geeks in cubicles, therefore let’s reflect that in the names we give them! How about names that reflect their likely poor personal hygiene (“Fartypants” or “stinky breath”). Most of the state APT crews are a bunch of weird bureaucrats (Glorified Civil Servants), or people who couldn’t find an honest job. Let’s give them names that reflect that reality.
For any analyst firms who are reading this article, you can use any name from my suggested list for free:
- Farty-Pants
- Stinky-Breath
- AsshatsInc
- Pale and Spotty
- Poor Personal Hygiene
- Needs a shower
- No Social Skills
- Slaves to the Man
- Failed Gamers
- Glorified civil servants
- Dressed by mother
- Nigel No-mates
And for the rest of us, let’s stop using these stupid names – these counter-productive names – and let’s stop giving them the credit that they don’t deserve.
Thanks to Patrick Grey and Risky Business for the inspiration for this article!
Please contact us if you see a ‘pretty name’ used for a cybercriminal – we would love to turn the industry around and stop giving cybercriminals the credit that they don’t deserve!