Full Report
Jen Easterly and Ciaran Martin called for a universal, vendor-neutral cyber threat actor naming system
Analysis Summary
This article focuses on a policy recommendation regarding threat actor naming conventions rather than detailing the activities of a specific threat actor. Therefore, the structured summary will reflect the discussion around attribution practices rather than a specific adversary.
# Threat Actor: N/A (Discussion on Naming Conventions)
## Attribution & Identity
The discussion centers on the *practice* of attribution, referencing historical examples like Mandiant's 2013 report on **APT1** (attributing activity to China’s People’s Liberation Army Unit 61398). Key figures calling for change are Ciaran Martin (former NCSC Director) and Jen Easterly (former CISA Director). The core issue described is the proliferation of different names for the same actor (e.g., Mandiant vs. MITRE naming schemes).
## Activity Summary
The article does not detail specific contemporaneous campaigns but focuses on the **historical debates** surrounding threat actor naming conventions sparked by high-profile attribution reports (like the 2013 APT1 report). The primary "activity" discussed is the need for current stakeholders to stop using "glamorized" names for cybercriminals and nation-state actors.
## Tactics, Techniques & Procedures
No specific TTPs for an actor are listed, as the focus is on naming conventions.
- Discussion of the debate over existing conventional naming schemes (e.g., vendor-specific names vs. vendor-neutral names).
- Mention of the goal to create a **vendor-neutral, public taxonomy** for global alignment and interoperability.
## Targeting
Not applicable for a specific actor. The discussion implies that **all actors** currently tracked under various names are the subject of this naming debate.
- Sectors: N/A
- Geography: N/A
- Victims: N/A
## Tools & Infrastructure
No specific malware or infrastructure are mentioned in relation to an active campaign.
## Implications
The implication is that current threat actor naming practices lack global alignment and can cause confusion (due to multiple names for one group). The call for a vendor-neutral taxonomy suggests a need for improved **interoperability** between public and private sector cyber defense efforts.
## Mitigations
The primary recommendation advocated by the former agency heads is:
- Cease using "glamorized" names for cybercriminals and nation-state actors.
- Adopt a **vendor-neutral, public taxonomy** for threat actors.
- Promote **global alignment** in threat reporting.