Loading malware…
Dino is a Windows espionage malware platform associated with the Animal Farm intrusion set, a long-running cluster widely linked in public reporting to French state-sponsored cyber operations. Within that toolkit, Dino is characterized as a full-featured second-stage spying implant, more advanced than validator-style components such as Tafacalou and used alongside other related families including Babar, Bunny, NBot, and Casper. Animal Farm activity has been observed since at least 2009, with development lineage extending earlier, and has targeted a broad international victim set including government entities, military contractors, humanitarian organizations, private companies, journalists, media organizations, and activists.
Dino is used after initial compromise and victim validation rather than as a simple first-stage foothold. Reporting indicates that Tafacalou functioned as an entry-stage implant that could lead to deployment of Dino or Babar on selected systems. This places Dino in the higher-value post-compromise portion of the intrusion lifecycle as a mature espionage platform intended for sustained intelligence collection.
The malware is part of a broader operational ecosystem that has employed multiple intrusion vectors across campaigns, including watering-hole operations and exploit-based delivery by related Animal Farm components. Public reporting specifically ties Casper to a watering-hole attack in Syria and Bunny to spear-phishing in earlier operations, while Dino itself is consistently described as an advanced espionage implant within the same toolkit. High-confidence reporting supports Dino’s role as a modular spying platform used against strategically significant targets worldwide, but detailed public technical disclosures on its internal functionality are more limited than for some sibling families.
Dino is best understood as one of the principal surveillance implants in the Animal Farm arsenal: a selective follow-on payload deployed against confirmed victims for deeper compromise, persistence, and intelligence gathering on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
1 distinct technique documented for this family, organized by ATT&CK tactic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as malware attributed to the French government-linked Animal Farm group; mentioned only for comparison/background.
Spying malware analyzed by ESET and described here as linked to an allegedly French espionage group.
Named as one of several implants in the Animal Farm toolkit, but not discussed further in this reference.
A full-featured espionage platform used by the Animal Farm group; confirmed victims can be upgraded to Dino from validator-stage malware such as Tafacalou.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.