branding

Threat actor names in cybercrime, such as LockBit or Fancy Bear, can originate from attackers themselves or be assigned by researchers and vendors, serving different purposes like branding, tracking, or analysis. While attacker-chosen names often function as public identities to support extortion or ideological goals, researcher-assigned names categorize behavior clusters for tracking and communication among defenders. Understanding these distinctions helps security professionals focus on the underlying behaviors and risks rather than just labels, improving exposure management and threat response.

https://blog.checkpoint.com/exposure-management/the-branding-and-attribution-behind-cybercrime/