Hello and welcome to the last lesson
from the module campaign analysis
in this video, we are going to talk
about threat intelligence, naming
conventions.
In this lesson, we will understand
the naming conventions that are used
by security researchers and
vendors.
We will seek common naming
conventions and what
exactly the reason that leads
to different names.
And we will finish this lesson
with my recommendations for
your naming conventions.
And naming convention is
a set of rules for choosing the
names to be used to identify
threat actors or speeches
or campaigns or operations.
And if we look at the current
threat landscape, we will find
so many different names
for one and the same threat
actor.
And just to let you know from
the start of this video,
there is no way to standardize
all of the names.
When it comes to the names
themselves, security firms tend
to have their own naming
conventions, meaning that
there will be multiple aliases
for any given Apte group
or threat actor.
It makes a confusing state of
affairs, but it is unlikely
to be resolved anytime soon.
Here are some examples of naming
conventions I mentioned
Cisco, Dallas and some other
vendors use numbers such as
Apte twenty eight or Apte
thirty for one,
restrike Kaspersky or
Symantec use fancy
names and naming schemes
that create an emotional
or methodological
context.
Bunda, for instance, refers to
China, while a reference to
Gattaca means Iren.
The reality is these are not
arbitrary names.
In fact, many are similar
to schoolyard nicknames.
Thyer to the attributes of
mysterious groups behind cyber
attacks and security researchers
tend to have an FBI like profiling
approach for these groups and
activities.
Cybercrime researchers build
profiles based on their typical
targeting tactics, malware
and techniques in order to follow
Apte activity and campaigns
around the world.
Sometimes they are also given
names which act as a handy
way to organize and catalog
threat patterns, often with
no to geography they
are thought to be associated with.
What can be the reason to lead
to different naming conventions?
There are human, technical and
operational reasons that
lead to all the different names.
In this slide, we are going to
discuss the different reasons
categorized by their type.
We will start with the human reasons
for the naming confusion's.
The first reason is when an
operation name is used as
a threat ectomy.
The second reason is when
a malware name is used as
a threat. Actually, the third
reason is when vendors Mr.
relate to other vendors research.
And the first reason is when
journalists are unwilling
to correct a wrong Mappin in public
articles.
When it comes to the technical
reasons why all these names
diverge, the first reason
is that every vendor sees
different pieces of the full
picture, different entities,
IAC clusters, sample
sets, C infrastructure,
etc..
The second reason is that threat
actors join forces
or split up.
The third reason is groups
share their toolset with others.
The fourth reason?
Groups share their seeto
infrastructure with other
groups, there are also less
technical and more operational
reasons that lead to different
Namik by using the name
of another vendor.
You may resent this decision
later if the other vendor
takes it in a direction
that you disagree with.
As vendors have collected and
constantly received different pieces
of the puzzle, agreeing
on middle name always
bears the risks of diverting
to maintaining
one's own name provides
flexibility and the option to
go down different routes.
By using another vendor's name,
you would implicitly admit
that the research of the other
vendor is more complete and
could be seen as the basis
of your own research.
It's a trade off between
that tactical advantage
and a reputation.
Reporting first doesn't mean that
the research is foundational
or more thorough, and therefore
other researchers don't see it
as an entitlement to assign a name.
So, as you can see, many
reasons lead to different naming
conventions.
The standardization of threat actor
names is not as easy
as it sounds.
The antivirus industry confronts
the same critics since many
years and cannot comply
with the demands for the very
similar reasons when
you are naming a campaign that you
are investigating.
It's highly recommended to avoid
numbers, even though some
of the vendors are doing it, doesn't
mean that it's the best option
because you may lose track of the
campaign numbers after a certain
time. The second recommendation is
naming after a tool used
in the campaign might end up
creating a confusion and analysts
might find themselves linking
unrelated campaigns just
because they are using the
same tool.
My third recommendation is
more about threats after naming
conventions, and here
I'm taking the example of Grousbeck
naming convention is definitely
a clever option.
But if you are not sure about the
origins of the threat actor,
you might end up naming multiple.
I have also some recommendations
for naming conventions that would
make your campaigns or threat actor
naming more appropriate.
Basically, it's not good to be
serious all the time and it
is fine to add some humor to your
naming convention.
It will make it easier to remember.
It's also significant to create
the name based on the incidents
that you are facing, not the ones
that you read about, but keep
in mind that they might be related
to the first site, but you might be
wrong after all.
Briefly, just be creative
and flexible.
In summary, this lesson was
a quick overview
of the naming conventions that
are used by cybersecurity
researchers and security
vendors.
We've seen some of the reasons that
may lead to different names.
And I gave you some recommendations
to name your own campaigns
or name the threat actors that
you are currently tracking.
This lesson was the last video
from the campaign analysis module.
In the next video, we'll start the
new module about attribution,
and the first lesson will be an
introduction to the module.