Initially this started internally at the US Government. Probably mostly the NSA, but then the vernacular spread. Kinda useful when having conversations to say

Initially this started internally at the US Government. Probably mostly the NSA, but then the vernacular spread. Kinda useful when having conversations to say "Cranky Frog" and not "China special operations group 304 PLA #122" The names were classified (Secret perhaps?), but at some point the US Government realized everyone was kinda using these names in conversations, probably not all at the secret level. These names had leaked out too much, they needed new names. So they decided to rename them with new Secret names, and just kinda let the old names become utilized. They tried to hide the old <-> new name mapping because the new name mapping was classified. Crowdstrike started as mostly former FBI / NSA employees. They liked using all these names to identify actors. But they realized they didn't want to use classified names. So they came up with their own very boring names (APT1, APT2 ,etc.). While others had always done this internally (Microsoft had names, Google had internal names, etc. etc.), Crowd strike utilized these names very publicly and it just kinda took off. I think the US Government at some point realized they could just use Crowdstrike names and avoid all of the Classified name mess, so they just utilized crowd strike names as well. So now Crowdstrike names are mostly the go-to. Unless you are micrososft, then you keep using your names.... My guess is Somewhere at Ft Meade an analyst has produced a massive, beautiful chart mapping all this shit together, and her sole job is to keep it updated. ...or this is my best guess anyway.