Why Hackers Get Nicknames: Inside the Naming of Cyber Threat Groups

For over a decade, cybersecurity firms have given hacking groups distinctive codenames such as 'Fancy Bear.' These names help researchers, journalists, and businesses quickly identify and discuss specific threat actors, even when their real-world identities remain unknown.

While some names have become widely recognised due to high-profile attacks, the practice serves a practical purpose within the security industry: tracking patterns of behaviour, tools, and targets used by different groups over time. This naming system allows analysts across different companies to compare notes and build a clearer picture of who is behind various cyberattacks.

For small business owners, these codenames might seem like industry jargon, but they matter because threat intelligence reports often reference them when describing risks relevant to your sector or region.