Campaign families
Every campaign we identify gets a stable codename like Scarlet Wolf — an adjective plus an animal. The animal is the family, and it tells you the operator's dominant target sector at a glance: a Wolf hunts banks, a Spider spins for inboxes, a Viper strikes crypto wallets. The adjective just keeps each campaign's name unique.
This is modelled on the industry convention of animal-suffixed actor names (CrowdStrike's Bear = Russia, Kitten = Iran). The key difference: our families denote what an operator targets and how they exfiltrate — both directly observed from the kits — not a nation-state attribution.