It is common; everything in security is an ambiguous acronym.
"C-and-C", for "command-and-control," is particularly vague and has multiple presentations-- C+C (Music Factory? An equation?), CnC (machining for materials fabrication), C2 (tutoring? Dicarbons?), C&C (a law firm?), CC (credit card).
APT (advanced persistent threat or Aptitude package manager?) is also annoying.
If you're curious, a whole bunch of security-related acronyms are reflected in the various product names and descriptions here: