Hacker News Reader

Comment by pjc50 | Hacker News Reader

> two China-affiliated threat actors known as Charcoal Typhoon and Salmon Typhoon; the Iran-affiliated threat actor known as Crimson Sandstorm; the North Korea-affiliated actor known as Emerald Sleet; and the Russia-affiliated actor known as Forest Blizzard.

I wonder who came up with those. The pattern is similar to the UK's https://en.wikipedia.org/wiki/Rainbow_Code , which makes me suspect that the threat actor attribution comes from US intelligence. With whom OpenAI are almost certainly cooperating.

Edit: Forest Blizzard == GRU, apparently. https://research.splunk.com/stories/forest_blizzard/

View on HN

How Microsoft names threat actors → https://learn.microsoft.com/en-us/microsoft-365/security/def...

Microsoft shifts to a new threat actor naming taxonomy → https://www.microsoft.com/en-us/security/blog/2023/04/18/mic...

It's amazing to me how there are really only 4 named countries (China, North Korea, Iran, Russia). I guess it's probably just more political and state sponsored than I would have guessed. Or it's not based on prevalence of attack sources and it's dictated more directly by some US policy? For example, you might also expect India because 1) it's a massive country with many people, 2) it's fairly independent and at least not a US ally, and 3) it's the home of plenty of malicious scam operations.

There aren't that many countries in the world with nation-scale hacker groups - the only ones I'd add is Israel with all their involvement into commercial spyware (and Mossad, whose capabilities likely surpass even the NSA), but they're heavily allied with the US.

> (and Mossad, whose capabilities likely surpass even the NSA)

What makes you say that ? Can you point to some interesting discussions / reporting ?

Everyone else outsources to NSO?

India’s an ally. It shares military bases with the USA and they’re also in each others favorite countries

That would be a very oversimplified conclusion. They are categorized as a major defense partner but are also rather close with Russia (getting 65% of their weapons from them [0]). They cooperate strategically but are rather independent. None of this is a slight to India - I'm just contrasting it to Europe which is decidedly in the US camp.

[0] https://www.reuters.com/world/india/india-pivots-away-russia...

OpenAI said this work was done in conjunction with Microsoft’s long established threat intel center, these are almost certainly the code names Microsoft security intel teams have assigned to these actors. Threat actor naming is generally a mess and every company has a different naming scheme for the same cluster of indicators/ttps

I am not a hacker nor security expert, so take this with a grain of salt. As I see it, there's one of two (general) ways a group will get a name:

1) The group themselves declares it (like Anonymous). Which means they need to explicitly leave their name somewhere.

2) The name is given by someone from the outside, such as the US.

I suspect 2 is quite common. I wouldn't expect most state level hackers leaving calling cards on systems. In fact, probably not most hackers at any level. It really seems like if state level actors were leaving calling cards that this would instead be misdirection rather than a tag. So I would not be surprised if they ended up getting US style naming schemes because it would be US (or other Westerners) identifying these people the same way you'd identify people by the style of actions and how they write. I know you can probably look at code from coworkers and know who wrote specific parts. Think like what you see in a movie with serial killers (or even real life). How do you know it is the same killer? Style.

I mean you could also get the name if you infiltrated the other country and then intimately studied their groups. The name of their group internally. But then you'd probably translate it. Still probably not a great idea to give that name out publicly though because then you could be hinting at how you obtained that information because different parts of the organization may refer to the same group by different names (specifically to do this. Military groups often run disinformation internally in secret channels).

Edit: guessmyname left a link to showing Microsoft names these.

https://www.microsoft.com/en-us/security/blog/2023/04/18/mic...

https://news.ycombinator.com/item?id=39372339

Reply on news.ycombinator.com