GINC-APT-0244 · State

SNOWGLOBE

Also Snowglobe, Animal Farm, ATK 8, ATK8, SIG20, Snowglobe, Animal Farm.

Category
State · Attributed to a state or working for one.
Origin
France(high confidence)
Sponsor
State-sponsored
Motivation
Espionage; Information theft and espionage
Seen
2011
Sources
7 sources carry it
Identifier
GINC-APT-0244 · snowglobe

What it is

In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild. Two of these zero-day vulnerabilities are associated with an advanced threat actor we call Animal Farm. Over the past few years, Animal Farm has targeted a wide range of global organizations. The group has been active since at least 2009 and there are signs that earlier malware versions were developed as far back as 2007.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

NSA leak
SIG20
Thales
ATK8
Other names
Snowglobe, Animal Farm, ATK 8, Snowglobe, Animal Farm

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Chinese and Russian sources

  • Kaspersky · 2015-03Babar/Bunny/Casper/Dino family; Canadian CSE slides attributed Babar to France.France · medium

Targets

Countries
Algeria, Austria, China, Congo, Cote d'Ivoire, Germany, Greece, Iran, Iraq, Israel, Ivory Coast, Malaysia, Morocco, Netherlands, New Zealand, Norway, Russia, Spain, Syria, Türkiye, Ukraine, United Kingdom, United States
Sectors
Defense, Government, Media, Private sector

Tools

The tools and malware families the sources tie to it.

  • Archelaus Beta
  • Babar
  • Back Orifice
  • Back Orifice 2000
  • Bunny
  • Casper
  • Chocopop
  • Cyber Eye RAT
  • CyberGate
  • Dino
  • EvilBunny
  • NBot
  • Tafacalou

Sources