In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild. Two of these zero-day vulnerabilities are associated with an advanced threat actor we call Animal Farm. Over the past few years, Animal Farm has targeted a wide range of global organizations. The group has been active since at least 2009 and there are signs that earlier malware versions were developed as far back as 2007.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Animal Farm |
| OSINT | Snowglobe |
| OSINT | ATK8 |
Sectors: Government, Private sector
Victim countries: Syria, United States, Netherlands, Russia, Spain, Iran, China, Germany, Algeria, Norway, Malaysia, Turkey, United Kingdom, Ivory Coast, Greece
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names SNOWGLOBE, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to SNOWGLOBE. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy.