There was a large leak that included what was basically an internal catalog of TAO-created devices and modules. That's what they are crossreferencing the codenames against.