4 ms·
>The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in th
by pizzalife 3y ago
>The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification).
From the article, there is no indication that the name comes from whoever authored the software. Sounds made up, and the way they obfuscate strings in the code makes me think it is not from a state-actor (definitely not one in the west).
- DiabloD3 3y agohttps://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set https://www.elastic.co/security-labs/introducing-the-ref5961... This contains language that leads me to believe they take contract work from state entities. So, either their sponsor names these, or they have internally taken to this style to better integrate into the state security apparatus.
- quesera 3y agoThat's reasonable enough. But ALCHEMY is not a verb.
- DiabloD3 3y agoThis is true. The verb would be Alchemise. There is no real hard rules on how to make these names, other than they have to be memorable, unique, and not actually describe the thing they're naming. Having a noun that can be verbed works well enough.
- quesera 3y agoThinking further though, I assume government project name generators have word lists, and I assume that BLOOD is not in those lists. The general proximity of both words to the retro previous-century hacker subculture conceit (guilty!) suggests to me that this name was chosen. I could be wrong, of course.