mjhjmtu

It appears that every time there's a vulnerability discovered major enough to hit the news, its been assigned a brand name and often even a logo. Heartbleed, Spectre, Meltdown, Foreshadow, etc. Who decides and produces these? Is it typically the person / group who discovered the bug, the group with responsibility for the affected product, or someone else?

I understand malicious software is typically named / branded by its author, but it seems odd that someone is out there coming up with names and designing logos for vulnerabilities.

They are all branded by the people discovering them. There's even a note on the wiki for Heartbleed:

Logo representing Heartbleed. Security company Codenomicon gave
Heartbleed both a name and a logo, contributing to public awareness of
the issue.

Spectre/Meltdown explains the branding on their site. As does Foreshadow (same artist).

Such publicity helps to make the issue mainstream and more shareable and suitable for pick-up by the general media. This helps to make the problem more well-known, as well as the people who created the brand. Just like any other marketing.

Given that it is relatively cheap to get a logo designed (welcome to the gig economy), the return on investment, even for an expensive logo, is huge if it gets picked up by the media.