Snowglobe, Animal Farm - Threat Group Cards: A Threat Actor
Encyclopedia
Archived: 2026-04-06 00:21:36 UTC
Home > List all groups > Snowglobe, Animal Farm
 APT group: Snowglobe, Animal Farm
Names
Snowglobe (CSEC)
Animal Farm (Kaspersky)
SIG20 (NSA)
ATK 8 (Thales)
Country France
Sponsor State-sponsored
Motivation Information theft and espionage
First seen 2011
Description
(GData) The revelation about the existence of yet another potentially nation-state driven
spyware occurred in March 2014 when Le Monde first published information about top secret
slides originating from 2011 and part of their content. But the slides Le Monde published
revealed only a small part of the picture – several slides were cut out, some information was
redacted. Germany’s Der Spiegel re-published the slide set with far less deletions recently, in
January 2015, and therefore gave a deeper insight about what CSEC actually says they have
tracked down.
The newly published documents reveal: the so called operation SNOWGLOBE, was
discovered in 2009 (slide 9) and consists of three different “implants”, two were dubbed
snowballs and one “more sophisticated implant, discovered in mid-2010” is tagged as
snowman (slide 7). According to slide 22, “CSEC assesses, with moderate certainty,
SNOWGLOBE to be a state-sponsored CNO [Cyber Network Operation] effort, put forth by a
French intelligence agency.” The information given dates back to 2011 and nothing else has
been published since. Now that specific Babar samples have been identified and analyzed,
there might be new information, also with regards to similarities or differences between the
two Remote Administration Tools (RATs) EvilBunny and Babar.
Observed Sectors: Defense, Government, Media and private sectors.
Countries: Algeria, Austria, China, Congo, Cote d'Ivoire, Germany, Greece, Iran, Iraq, Israel,
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1321cfb0-511e-41a0-86a5-e7f1582911af
Page 1 of 2

Malaysia, Morocco, Netherlands, New Zealand, Norway, Russia, Spain, Syria, Turkey, UK,
Ukraine, USA.
Tools used Babar, Casper, Dino, EvilBunny, Tafacalou, Nbot, Chocopop.
Information
Last change to this card: 24 April 2020
Download this actor card in PDF or JSON format
Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1321cfb0-511e-41a0-86a5-e7f1582911af
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1321cfb0-511e-41a0-86a5-e7f1582911af
Page 2 of 2