SNOWGLOBE (Animal Farm, ATK8) is a nation-state APT group from France targeting government and private sectors across numerous countries.
Analyst brief
SNOWGLOBE (Animal Farm, ATK8) is a nation-state APT group originating from France. They target government and private sector entities across a wide range of countries, including Syria, US, Iran, China, Turkey, UK, Russia, and Germany. Active since at least 2009, the group was exposed using two zero-day vulnerabilities discovered by Kaspersky in 2014, with malware development traces dating back to 2007. Defenders should prioritize patch management for zero-day exploits and investigate indicators related to their long-standing malware lineage.
SNOWGLOBE
Animal FarmSnowglobeATK8
nation-state
In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild. Two of these zero-day vulnerabilities are associated with an advanced threat actor we call Animal Farm. Over the past few years, Animal Farm has targeted a wide range of global organizations. The group has been active since at least 2009 and there are signs that earlier malware versions were developed as far back as 2007.
origin (suspected)
🇫🇷France· state-sponsoredattribution confidence: medium (50)