Why Google’s Hacker Names Matter for Your SME
When you hear that Google just renamed thousands of hacker groups, you might shrug. You run a small business in Malaysia. Your café, furniture shop, or logistics firm doesn’t exactly look like a prime spy target. So why should you care about codenames like “Castle” or “Relic”?
Here’s the thing: the hackers behind these names are often the same people whose tools end up in your inbox, pretending to be an invoice, or locking your files behind ransomware. Big security companies name and track these groups for one practical reason — to make it easier to defend against them. Even if you never learn a single codename, this behind-the-scenes system helps protect the software and cloud services you rely on every day.
TL;DR: Google recently simplified its hacker-group naming system, replacing confusing numbers like APT41 with memorable words like “Castle” (China), “Ion” (Iran), “Neptune” (North Korea), and “Relic” (Russia). This helps security teams share information faster, and your business benefits indirectly — as long as you keep your own digital basics strong.
What This Means: Hacker Groups Are Tracked Like Cyclones
For over a decade, cybersecurity firms have given hacking groups codenames to help professionals communicate about threats on a global scale, as TechCrunch explains. It’s not about giving villains cool nicknames. It’s about building a historical profile: who a group attacks, how they infiltrate systems, what their goals are, and which tools they use. You can think of it like naming hurricanes. One clear name is easier to track than a long technical code.
Google now tracks more than 5,000 of these “activity clusters” across multiple countries, according to John Hultquist, chief analyst at Google Threat Intelligence Group. That’s a lot of noise to keep sorted. The old system, created by Mandiant back when it was an independent firm, used codes like APT1 and APT41. Those made sense to security insiders but were often cryptic to everyone else.
Google’s new system keeps it simple: a random first name plus a second word whose initial signals the country of origin. Instead of “APT41,” security staff can say “Castle” and immediately know they’re dealing with a Chinese-state-owned group. This clarity means better sharing among companies, faster threat modeling, and — in theory — stronger protection for everyone downstream.
| Country | Second Word | Signals |
|---|---|---|
| China | Castle | State-sponsored groups |
| Iran | Ion | State-sponsored groups |
| North Korea | Neptune | State-sponsored groups (e.g., Lazarus Group) |
| Russia | Relic | State-sponsored groups |
Source: Google’s naming system as reported by TechCrunch.
How This Applies to Malaysian SMEs
Let’s bring this back to your business. You may not be a national leader or a defense contractor, but you do hold something valuable: data, money, and system access. Cybercriminals — and sometimes state-sponsored actors — don’t necessarily need to target you personally. They use automated tools that scan the internet for weak points. Once they find your outdated server or a careless employee who clicks on a good enough phishing link, they’re in. These same groups are often the ones being tracked and named by companies like Google. When a new codename appears, security vendors update their detection systems to match that group’s known behavior. That means your cloud email, your accounting software, and your firewall get better at spotting malicious traffic before it reaches you.
Take the Lazarus Group, the North Korea-linked threat actor mentioned by name in the TechCrunch article. Security products have studied the Lazarus Group’s tactics for years — their typical malware, their favorite phishing lines, their ransomware playbooks. As a result, your antivirus provider or managed IT partner already has filters that block Lazarus-related signatures. Google’s new naming system, and the industry’s broader practice of naming and tracking groups, is exactly what makes that automatic protection possible. You never see the codename. But you receive the benefit every time a malicious attachment is blocked before your staff even knows it arrived.
However, there is a catch. This system only helps you if your tools are modern, updated, and actually used properly. If your business is still running on an old email platform without two-factor authentication, or if you never patch your software, all the codenames in the world won’t protect you. As Google’s Shane Huntley said, “No one has perfect visibility. We are building our model and our best understanding, but we will never know everything about what’s going on.” That’s a blunt but honest reminder. The security industry does its part by tracking bad actors. You have to do your part by keeping the basics in place.
There’s another angle that’s particularly relevant for Malaysian business owners. If you work with an IT vendor or a managed cybersecurity provider, you may start hearing terms like “Castle” or “Relic” in their reports or recommendations. Now you know what they mean. Instead of nodding silently, you can ask better questions: “What protections do we have against that specific group?” or “If they hit us, how quickly can we restore from backup?” Being a smart buyer of cybersecurity services starts with understanding the language.
“No one has perfect visibility. We are building our model and our best understanding, but we will never know everything about what’s going on.” — Shane Huntley, Google Threat Intelligence Group
Practical Takeaways for Your Business
- Assume you’re a target. Automated attacks don’t discriminate based on company size. A Malaysian SME with weak security is an easy win for any group.
- Keep everything updated. Use automatic updates for your operating systems, plugins, and cloud apps. Security patches often address the exact vulnerabilities tracked groups use.
- Turn on two-factor authentication (2FA). This single step blocks a huge portion of account takeover attempts, including those from state-sponsored groups.
- Back up your data — and test your backups. If ransomware strikes, you want the ability to restore without paying. Offline backups are even better.
- Train your employees. Phishing is still the number one entry point. Show your staff what a suspicious email looks like and give them an easy way to report it.
- Ask your IT provider about threat intelligence. Find out if they use vendor research, like Google’s new naming system, to keep your defenses current.
The Bigger Picture
Naming hacker groups isn’t just an internal hobby for security researchers. It’s a response to an increasingly complex threat landscape where nearly every developed nation has its own cyber capabilities. Google’s move to unify naming systems is part of a broader trend toward clearer communication and faster collaboration across the industry. But for Malaysian SMEs, the long-term lesson is more personal: cyber threats are organized, persistent, and predictable — but that also means they can be defended against.
You don’t need to become a security expert, and you certainly don’t need to memorize codenames. What you need is to build your business on fundamentals — strong passwords, smart employees, and a disciplined approach to software and backups. When you automate your operations or move more of your business online, treat security as part of that journey, not as an afterthought. The world of hacker codenames is far from perfect, but it’s a world that works better when each Malaysian business owner does their small part.
Ready to Streamline Your Operations?
Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →