Resources • Videos
Security operations

Red Canary Office Hours: Episode 41 – Bird feed: How Red Canary names and tracks threats

Air Date: November 11, 2025

How Red Canary names and tracks threats

Dave and Keith are joined by Alex Berninger, Senior Manager of Intelligence at Red Canary, to shed light on the challenges of naming threat activity clusters.

By pulling back the curtain on Red Canary’s methodology, which continues to evolve and embrace the complexity of the issue, Alex guides you through the factors that shape naming decisions and the lessons learned along the way.

Episode 41: Bird Feed

Resources mentioned in this episode

Gootloader Is Back (Back Again)

Field Guide to Color Bird Threats

A definitive guide to “color birds,” what we call fledgling activity clusters we’ve named after tracking patterns of malicious behavior.

Related Resources

Red Canary Office Hours: Episode 43 – Defense-in-depth strategies to keep you warm

Videos| Security operations

Red Canary Office Hours: Episode 43 – Defense-in-depth strategies to keep you warm

Red Canary Office Hours: Episode 42 – A cornucopia of Intelligence Insights

Videos| Security operations

Red Canary Office Hours: Episode 42 – A cornucopia of Intelligence Insights

Red Canary Office Hours: Episode 40 – The hidden tunnels of STORM-2603’s ransomware ops

Videos| Security operations

Red Canary Office Hours: Episode 40 – The hidden tunnels of STORM-2603’s ransomware ops

Red Canary Office Hours: Episode 39 – Nightmare on supply chain street

Videos| Security operations

Red Canary Office Hours: Episode 39 – Nightmare on supply chain street

Security gaps? We got you.

Sign up for our monthly email newsletter for expert insights on MDR, threat intel, and security ops—straight to your inbox.

Back to Top