Keynote: Dmitri Alperovitch

Keynote: Dmitri Alperovitch

Speakers: Dmitri Alperovitch

Conference: CYBERWARCON

YouTube: https://www.youtube.com/watch?v=4bqQf_VAWNc

Overview

In this keynote address at CYBERWARCON, renowned cybersecurity expert Dmitri Alperovitch delivers a provocative and self-critical analysis of the prevailing chaos in threat actor naming conventions. Characterizing the current state as a "dumpster fire," Alperovitch, who admits to having inadvertently initiated the problem over a decade ago, outlines the systemic issues plaguing the industry's approach to identifying and communicating about nation-state adversaries. His talk serves as both a mea culpa and an urgent call to action, urging the cybersecurity community to adopt a more standardized, rational, and audience-centric approach to attribution.

Alperovitch’s central thesis revolves around the critical need for simplification and the prioritization of credible government attribution. He argues that the proliferation of hundreds of often-redundant and confusing monikers, such as "Cozy Bear" and "Fancy Bear," has undermined the original goals of clarity and memorability. Instead, it has fostered an environment where essential intelligence is obscured by an overwhelming "Rosetta Stone" of arbitrary names, hindering effective communication across industry, media, and the public.

The talk is a direct challenge to the status quo, advocating for a pragmatic shift away from cute animal names and weather phenomena towards a system grounded in publicly available government attribution, or, in its absence, a clear and consistent methodology tied to country, agency, and specific Tactics, Techniques, and Procedures (TTPs). Alperovitch seeks the community's help in resolving a problem he feels he significantly contributed to, emphasizing that a more coherent naming strategy is crucial for improving threat intelligence sharing and public understanding of the cyber landscape.

Background

▶ Watch: Admitting fault: The origin of threat actor naming. (0:00)

The genesis of the current threat actor naming conundrum, as Alperovitch frankly admits, traces back to his own pioneering work in public attribution. Beginning around 2010, in the wake of Operation Aurora, Alperovitch embarked on a two-year period of publicly revealing sophisticated cyber operations, each christened with memorable, often evocative names like Night Dragon, Shady Rat, and 10 Days of Rain. This trend, arguably predated by Citizen Lab's groundbreaking Ghostnet report in 2009, quickly highlighted a fundamental challenge: the sheer volume of discovered operations made individual naming unsustainable and ultimately unhelpful.

Recognizing this, Alperovitch shifted focus from naming operations to naming the persistent threat actors behind them. In 2011, he proposed a standardized naming scheme, partially inspired by government practices, featuring a two-word structure: a descriptive adjective followed by an animal name. This led to the now-ubiquitous "pandas" for China and "bears" for Russia. The motivations behind this initiative were clear and compelling:

1. Standardization: To move away from ad-hoc operation names.
2. Memorability: To create easily recallable names for a broader audience, including media and the public, who might not be deep cybersecurity researchers.
3. Public Attribution: To facilitate public identification of nation-state threats, particularly at a time when governments were reluctant to publicly attribute cyberattacks (e.g., "the government would not even say the word cyber and and China in the same sentence").
4. Limited Scope: Alperovitch initially envisioned a manageable number of major threat actors (China, Russia, Iran, North Korea), each with a few associated intelligence or military agencies.
5. Flipping the Narrative: To de-glamorize adversaries by giving them seemingly innocuous or even cute names, such as "Cozy Bear," to make them less intimidating and more approachable for public discourse.

However, what began as a well-intentioned effort to bring clarity and public awareness soon spiraled into a complex and unmanageable system. Alperovitch points to 2016 as a turning point, exemplified by a video clip where a news anchor humorously questioned the name "Cozy Bear" in the context of serious geopolitical events. The initial vision of a few memorable names quickly gave way to a "zoo" of animal names, weather phenomena, and other arbitrary monikers from various security vendors. This proliferation, Alperovitch contends, has undermined the very goals it sought to achieve, creating more confusion than clarity.

Key Findings

▶ Watch: Original five reasons for standardized threat actor naming. (3:00)

Alperovitch’s core argument is that the current state of threat actor naming is not merely inconvenient but fundamentally broken, hindering effective communication and analysis. He presents several critical findings that underscore the severity of this "dumpster fire":

First, the sheer scale of the naming problem is staggering. As of the talk, Alperovitch noted that a "Rosetta Stone" of threat actor names contains over 430 group names across more than a dozen different naming schemes from various companies. He even leveraged GPT to estimate that, on average, there are "more than six per individual group," leading to immense confusion and redundancy. This multitude of names makes it virtually impossible for anyone outside a small circle of experts to keep track of who is who, defeating the original purpose of memorability.

Second, the original need for vendor-driven naming has largely been superseded by credible government attribution. Starting with the PLA indictments in 2014 (referring to APT1 and Unit 61398), governments, particularly the U.S., have increasingly stepped up to publicly identify and sanction cyber threat actors. Alperovitch highlights that these official pronouncements often provide far more precise and verifiable details than any vendor-assigned moniker. He questions the utility of names like "Salt Typhoon" when the Treasury sanctions directly name the responsible entity, such as the "Sichuan Who Network Security Network Technology Company." Similarly, "Fancy Bear" seems redundant when the GRU unit 26165 is publicly identified, or "Lazarus" when North Korea's RGB (Reconnaissance General Bureau) is cited, with specific individuals like Spark Jin Walk being indicted. These government actions provide not just names but often pictures, group affiliations, and detailed indictments, making cute, vendor-assigned names largely obsolete for those seeking definitive attribution.

Third, Alperovitch identifies a pervasive problem of excessive precision in vendor attribution, often without the necessary intelligence community (IC) or law enforcement (LE) resources to sustain such granularity. While the IC and LE might care about an individual or a specific unit, most audiences—customers, media, the public—do not require or benefit from such minute detail. This over-precision leads to several critical issues:

• TTPs vs. Organizations: A single organization or unit can employ different TTPs for different target sets (e.g., high-value vs. commodity intelligence collection), making a direct 1:1 mapping between a group name and a consistent set of TTPs problematic.
• Organizational Reorganizations: Government agencies, especially in adversary nations, undergo frequent reorganizations. Alperovitch cites the example of 3PLA (Third Department of the General Staff of the People's Liberation Army), which included Unit 61398 (often associated with APT1), disappearing in the mid-2010s due to a massive reorganization by Xi Jinping. When the underlying organizational structure changes, the group names become stale or meaningless.
• Personnel Reassignments: Individuals within these units are frequently reassigned, taking their tradecraft and tools with them. This means an individual previously associated with one "group" might now be performing similar activities for an entirely different unit, blurring the lines of attribution and making fixed group names misleading.
• Stale Names: There is no industry-standard mechanism to "stale out" group names, similar to how Indicators of Compromise (IOCs) can become stale. This leads to an ever-growing list of potentially defunct or misleading names that persist in reports and databases.

Ultimately, Alperovitch questions whether anyone, beyond a very niche audience, truly cares about the granular details like "GRU 26165" if the broader message of "Russia" or "GRU" is sufficient for their needs. The current system prioritizes internal analyst precision over external audience comprehension, creating an unnecessary barrier to understanding.

Technical Deep Dive

▶ Watch: Government attribution makes 'cute names' obsolete. (5:30)

The "technical debt" accumulated in threat actor naming schemes, as highlighted by Alperovitch, stems from a fundamental misalignment between the needs of deep intelligence analysis and the broader communication requirements of the cybersecurity industry. The core of this problem lies in the attempt to force a static, precise name onto dynamic, fluid entities, particularly within the clandestine operations of nation-states.

Alperovitch meticulously breaks down the issues arising from what he terms "too much precision" without the necessary foundational intelligence:

1. TTPs and Organizational Flux: The assumption that a specific set of TTPs consistently maps to a singular, static "group" or unit is flawed. As Alperovitch explains, a single unit within an intelligence agency might employ a diverse array of TTPs depending on the target's value. A high-value target might warrant sophisticated, bespoke tooling and stealthy tradecraft, while a low-value, commodity intelligence collection priority might involve off-the-shelf tools and less refined techniques. Attributing a "group" based solely on observed TTPs can therefore lead to the creation of multiple distinct group names for what is, in reality, a single organizational entity with varied operational profiles. This granularity, while potentially useful for internal tracking by intelligence agencies, becomes confusing and misleading when abstracted into public-facing group names.

1. Impact of Reorganizations: Nation-state intelligence and military agencies are not static corporations; they undergo frequent and often opaque reorganizations. Alperovitch provides a salient example with the People's Liberation Army (PLA) in China. The unit famously linked to APT1, Unit 61398 of the 3PLA, no longer officially exists in its original form. A massive reorganization initiated by Xi Jinping in the mid-2010s restructured the PLA, dissolving or reassigning many units. When the organizational structure that a group name was based upon ceases to exist, the name itself becomes an anachronism. This creates a historical artifact in threat intelligence that can confuse new analysts and misrepresent the current operational landscape. It's akin to meticulously naming every department in a company, only for the company to undergo a complete restructuring, rendering all previous department names irrelevant, yet they persist in old reports.

1. Personnel Reassignments and Tradecraft Migration: Beyond organizational shifts, individual personnel within these units are frequently reassigned. An analyst or operator working on one team might be temporarily detailed or permanently transferred to another team or even an entirely different unit. Crucially, these individuals often take their learned tradecraft and even their preferred tools with them. This phenomenon directly undermines the premise of precise, TTP-based group attribution. If an individual responsible for a distinct set of TTPs moves from "Group A" to "Group B," then "Group B" might suddenly exhibit TTPs previously attributed solely to "Group A." This leads to a mixing of attribution, where activities previously thought to be exclusive to one group are now observed elsewhere, causing confusion and making it challenging to maintain a clean separation between named entities. The problem of "stale names" is exacerbated by this, as there is no industry mechanism to retire or consolidate group names when such internal shifts occur.

To address these systemic issues, Alperovitch proposes a pragmatic, tiered algorithm for threat actor naming, prioritizing clarity and verifiable attribution:

Proposed Naming Algorithm:

1. Prioritize Government Attribution:

• If a trusted, public government attribution source exists (e.g., indictments, sanctions, official government statements), use it.
• The level of precision should be chosen based on the audience's needs:
• Individual Name: For highly specific contexts (e.g., "Spark Jin Walk" from an indictment).
• Unit Name: If a specific unit is publicly identified (e.g., "GRU 26165").
• Agency Name: For broader attribution (e.g., "GRU," "RGB").
• Country Name: For the broadest audience (e.g., "China," "North Korea," "Russia").
• The key is to leverage the official, verifiable source directly, rather than re-interpreting it through a vendor-specific lens.

1. If No Government Attribution (or insufficient detail):

• Start with the Country: If the country of origin is known, simply state the country (e.g., "China," "North Korea"). This provides immediate, understandable context for a broad audience.
• Add Agency (if known): If the specific agency is known, include it (e.g., "RGB" for North Korea's Reconnaissance General Bureau). This adds a layer of precision without resorting to arbitrary monikers.
• Append TTP (if unique and relevant): If there is a highly unique and distinctive TTP associated with the activity that needs to be highlighted, append it to the country or agency name. This allows for technical specificity where it matters most, without inventing a new group name.
• Examples:
• "JRU Sandworm" (referring to the GRU-affiliated group known for the Sandworm TTPs).
• "Boyack Plugax" (a placeholder for a specific, identifiable TTP set).
• "MOS from Mexi" (another placeholder, indicating a specific TTP originating from a known agency).

This algorithm aims to eliminate the "Rosetta Stone" problem by providing a clear, logical hierarchy for naming. It ensures that public-facing communication is immediately understandable, reduces the cognitive load of tracking numerous redundant names, and focuses on verifiable facts rather than vendor-specific branding. It allows for precision when needed (e.g., for security researchers) but simplifies for general audiences (e.g., media, executives), ultimately making threat intelligence more accessible and actionable.

Demo / Proof of Concept

▶ Watch: Problems with over-precision and stale threat names. (6:20)

This keynote address by Dmitri Alperovitch was a conceptual and policy-oriented talk, focusing on systemic issues within the cybersecurity industry's attribution practices rather than demonstrating a specific tool or exploit. As such, no live demo or proof of concept was presented during the session.

Defensive Implications

▶ Watch: Proposed algorithm for future threat actor naming. (9:45)

Alperovitch's call to action has significant implications for cyber defenders, ranging from individual analysts to organizational security leadership. The proposed shift in naming conventions is not merely an academic exercise; it offers a pathway to more effective threat intelligence consumption, sharing, and communication.

1. Prioritize Government Attribution in Intelligence Processes: Defenders should actively integrate publicly available government attribution into their threat intelligence platforms and internal reporting. When the U.S. Treasury sanctions a specific entity like "Sichuan Who Network Security Network Technology Company" or the Justice Department indicts individuals linked to GRU unit 26165, these official names and identifiers should take precedence. This reduces reliance on potentially ambiguous or outdated vendor-specific names, providing a more authoritative and legally backed foundation for intelligence.

1. Simplify Internal and External Communication: Security teams often use highly granular, internal group names that are meaningful to a small subset of experts but confusing to others. Alperovitch's algorithm encourages simplifying communication based on the audience. For executive briefings, media interactions, or customer reports, using "Russia" or "China" or "GRU" is often sufficient and more impactful than referring to "Fancy Bear" or "APT28." This ensures that the core message about the threat actor's origin and intent is conveyed clearly, without getting bogged down in jargon or requiring a "Rosetta Stone" for interpretation.

1. Focus on TTPs, Not Just Names: While the talk critiques overly precise group names, it reinforces the enduring importance of Tactics, Techniques, and Procedures (TTPs). By appending TTPs to country or agency names (e.g., "GRU Sandworm"), defenders can maintain technical specificity where it matters for detection and response. This approach encourages a deeper understanding of adversary behaviors rather than just memorizing names, allowing for more resilient defenses against evolving threats, regardless of which specific unit or individual is executing them.

1. Critically Evaluate Vendor Attribution: Defenders should be more critical consumers of threat intelligence vendor reports. If a vendor introduces a new, obscure group name without clear linkage to government attribution or a highly distinct and persistent set of TTPs, security teams should question its utility and consider whether it adds more noise than signal. The goal should be to consolidate and align internal naming with the most authoritative public sources available.

1. Improve Threat Intelligence Sharing: A standardized, simplified naming scheme facilitates better information sharing across organizations and with government partners. When everyone refers to the same entities using consistent, verifiable names, the ambiguity that often plagues collaborative efforts is significantly reduced. This can lead to faster, more coordinated responses to major cyber incidents.

1. Adapt to Organizational Realities: Understanding that threat actor organizations are dynamic and subject to reorganizations and personnel shifts (like the disappearance of 3PLA or reassignment of individuals) allows defenders to build more flexible threat models. Instead of rigidly tracking "groups" that may no longer exist, focus can shift to the enduring capabilities, motivations, and broad affiliations of nation-state actors, making intelligence more resilient to internal adversary changes.

By embracing Alperovitch's recommendations, defenders can move towards a more rational, efficient, and impactful approach to understanding and communicating about cyber threats, ultimately enhancing their ability to protect their organizations.

Key Takeaways

• The current state of threat actor naming, with over 430 group names across 12+ schemes, is chaotic, confusing, and counterproductive, undermining effective communication.
• Publicly available government attribution (e.g., indictments, sanctions) should be the primary and most authoritative source for identifying threat actors, as it provides verifiable details.
• Excessive precision in naming, particularly by vendors, is often unsustainable and misleading due to the dynamic nature of adversary organizations (reorganizations, personnel shifts) and varied TTPs within single units.
• A proposed algorithm prioritizes government attribution; in its absence, it advocates for naming by country, then agency, with optional appended unique TTPs for technical specificity (e.g., "GRU Sandworm").
• The goal is to simplify threat intelligence for broader audiences (media, public, executives) while maintaining necessary technical detail for cybersecurity professionals, eliminating the need for complex "Rosetta Stones."
• Adopting a standardized, audience-centric naming approach will improve clarity, memorability, and the overall effectiveness of threat intelligence sharing and defensive strategies.

About the Speaker(s)

Dmitri Alperovitch is a highly influential figure in the cybersecurity community, known for his pioneering work in public attribution of nation-state cyberattacks. As he revealed in this keynote, he was instrumental in popularizing the practice of naming threat operations (like Operation Aurora, Night Dragon, Shady Rat) and later, the standardized animal-themed naming conventions (e.g., "pandas," "bears") during his time as a co-founder and CTO of CrowdStrike. Throughout his career, Alperovitch has been a passionate believer in public attribution as a critical tool for educating the public about cyber threats and holding adversaries accountable, a conviction that continues to shape his advocacy for clearer, more impactful communication in cybersecurity.