Outpost24’s KrakenLabs explains a threat-actor naming convention that clusters adversaries by observed capabilities, infrastructure, victims, and TTPs rather than relying solely on another vendor’s attribution labels. The methodology uses adjective-plus-poisonous-plant names, with different plants representing actor origins or activity types; the excerpt introduces Churihyang, the Korean name for Daphne odora, in the section covering Korean threat actors. This source is primarily attribution-methodology context for CTI consumers, not a report on a specific Lazarus intrusion, malware sample, or victim incident.