Former CISA and NCSC Heads Warn Against Glamorizing Threat Actor Names

Former leaders of the UK NCSC and US CISA call for a vendor-neutral, globally standardized naming system for cyber threat actors, arguing that today’s fragmented, often glamorized codenames (e.g., Fancy Bear, Volt Typhoon) hinder attribution, confuse SOCs and leadership, and delay response. While welcoming Microsoft and CrowdStrike’s recent effort to align adversary naming—deconflicting over 80 groups—they contend cross-referencing proprietary labels is insufficient without a universal taxonomy promoted by governments and law enforcement. They propose practical, non-glamorizing labels (e.g., country-based) and note other domains have successfully standardized complex nomenclature, making similar reform in cyber both feasible and overdue.