- Category
- State · Attributed to a state or working for one.
- Origin
- France(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2011
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0244 · snowglobe
What it is
In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild. Two of these zero-day vulnerabilities are associated with an advanced threat actor we call Animal Farm. Over the past few years, Animal Farm has targeted a wide range of global organizations. The group has been active since at least 2009 and there are signs that earlier malware versions were developed as far back as 2007.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- NSA leak
- SIG20
- Thales
- ATK8
- Other names
- Snowglobe, Animal Farm, ATK 8, Snowglobe, Animal Farm
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Chinese and Russian sources
- Kaspersky · 2015-03Babar/Bunny/Casper/Dino family; Canadian CSE slides attributed Babar to France.France · medium
Targets
- Countries
- Algeria, Austria, China, Congo, Cote d'Ivoire, Germany, Greece, Iran, Iraq, Israel, Ivory Coast, Malaysia, Morocco, Netherlands, New Zealand, Norway, Russia, Spain, Syria, Türkiye, Ukraine, United Kingdom, United States
- Sectors
- Defense, Government, Media, Private sector
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Babar
- Back Orifice
- Back Orifice 2000
- Bunny
- Casper
- Chocopop
- Cyber Eye RAT
- CyberGate
- Dino
- EvilBunny
- NBot
- Tafacalou
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de