A cryptonym is a code-style name used by threat-intelligence teams to identify and track a specific threat cluster, actor, campaign, or operation. It is designed to be short, searchable, and consistent across reports, case notes, and internal tools. In security work, a cryptonym is not the same as proof of identity; it is a reference label that helps analysts organize evidence and compare activity over time.
Cryptonyms matter because cyberattacks are often observed in fragments: phishing emails, malware samples, infrastructure, and attacker behavior. A stable name helps defenders connect those fragments and share findings without confusion. It is especially useful when multiple teams are tracking similar activity, since duplicate or drifting labels can hide relationships and slow response. At the same time, defenders should treat cryptonyms as a convenience, not an attribution conclusion; the real analysis still depends on tactics, techniques, indicators, and context.