Hacker group naming schemes, such as Microsoft's new system, are counterproductive for cybersecurity analysis; a government body should set a naming convention
Pumpkin Sandstorm. Spandex Tempest. Charming Kitten. Is this really how we want to name the hackers wreaking havoc worldwide?
Context & Ripple Effects
Days before this critique ran, Microsoft rolled out its weather-themed actor names — typhoons for nation-state groups, sandstorms for others — adding yet another proprietary vocabulary on top of CrowdStrike's animals and everyone else's cats and kittens. The argument lands on a problem with a long paper trail: naming viruses and vulnerabilities has been contested since at least 2018, when thousands of new discoveries a year made standout labels both a branding tool and an analytic liability.
The stakes are not cosmetic. In 2018, researchers only discovered that many 'independent' groups were one operation after opsec slips let them merge a decade of activity under the Winnti Umbrella label — proof that fragmented naming actively hides aggregation. And Washington has tried codifying cyber language before, with the Cyber Incident Severity Schema announced in 2016 but left short on specifics.
First-order effects
- Analysts correlating reports from Microsoft, CrowdStrike, Google, and Palo Alto Networks must manually reconcile aliases for the same group — Spandex Tempest and Charming Kitten exist because each vendor mints its own name for overlapping activity.
- Microsoft's scheme makes its own threat intelligence harder to cross-reference against rival trackers, raising the cost of using any single vendor's reporting as ground truth.
Second-order effects
- Vendor coordination becomes the pressure-release valve: by mid-2025 Microsoft, Google, CrowdStrike, and Palo Alto Networks moved to publish a shared public glossary of state-sponsored groups, effectively conceding that alias proliferation was hurting the whole sector.
- A credible government convention would shift competitive dynamics in threat intel from who coins the catchiest name to whose detections map fastest onto the official registry.
Third-order effects
- If a state body standardizes actor naming the way the 2016 severity schema attempted for incident levels, attribution itself becomes more auditable — merged clusters like Winnti Umbrella would surface sooner, and vendor-branded taxonomies risk becoming secondary metadata rather than primary identifiers.
- The unresolved question is whether governments move faster than vendors' voluntary glossary effort; the 2016 schema shows federal codification can stall on specifics while industry fills the vacuum on its own terms.
The trend: Threat intelligence is drifting from competing vendor-branded naming schemes toward shared registries, with pressure mounting for an official body to arbitrate the taxonomy vendors cannot settle among themselves.