Loading story…
Researchers analyzed a 2007 sample of Babar, also known as SNOWBALL, and found it to be an early component of the Animal Farm espionage toolkit. The malware consisted of a loader and payload DLL, used RC4-encrypted configuration data, persisted through Windows Run registry keys, injected into Internet Explorer, and contacted a command-and-control server hosted on a compromised third-party website. It gathered victim system information, stored encrypted identifiers in the registry, and supported remote actions including file download, process listing and termination, reboot, shutdown, and self-removal.
The findings push back the known history of Babar by several years and reinforce its connection to the broader Animal Farm operation previously tied to global espionage activity. Kaspersky had described Animal Farm as a long-running threat actor targeting governments, military contractors, humanitarian groups, companies, journalists, media outlets, and activists, with malware families including Bunny, Dino, Babar, NBot, Tafacalou, and Casper. The older SNOWBALL sample shared similarities with the Casper implant, while researchers also noted a coding bug and a design flaw in the early Babar variant, exposing weaknesses not usually associated with a mature intelligence-grade platform.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
In September 2017, Palo Alto Networks published analysis of a 10-year-old Babar/SNOWBALL sample, documenting its loader, payload, persistence, RC4-encrypted configuration, and use of a compromised third-party website for command and control. The analysis established that this Babar variant predated previously known 2011 samples.
In March 2015, Kaspersky published a report grouping Animal Farm malware into six major families: Bunny, Dino, Babar, NBot, Tafacalou, and Casper. The report described the actor as a long-running espionage group targeting governments, contractors, NGOs, companies, journalists, media, and activists worldwide.
Kaspersky reported in 2014 that three zero-day vulnerabilities were being exploited in the wild and associated two of them with the Animal Farm threat actor. This connected the group to active zero-day operations.
Kaspersky described Bunny as an older validator-style Trojan used by Animal Farm in a PDF zero-day attack in 2011. This tied one of the toolkit's earlier malware families to a specific exploitation campaign.
Kaspersky said the Animal Farm espionage group had been active since at least 2009. The report also noted signs that some earlier malware versions may have been developed as far back as 2007.
Palo Alto Networks analyzed a Babar (SNOWBALL) loader and payload DLL whose compilation timestamps were both on November 9, 2007, showing the malware family existed earlier than previously documented 2011 samples. The sample was identified as an early tool in the Animal Farm toolkit.
During its investigation, Kaspersky sinkholed a large number of Animal Farm command-and-control servers and used Tafacalou infection logs to identify victims across numerous countries. The findings showed Tafacalou acted as an entry-stage implant that could lead to deployment of Babar or Dino.
Kaspersky said the Casper Trojan was the most recent validator-style implant from Animal Farm and that it had been deployed in a watering-hole attack in Syria. The report did not provide a more precise date for that operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a previously unreported backdoor dubbed **Filesnfer**, highlighting malware samples in both **Python** and **C#** that were associated with suspected China-linked espionage activity and discussed alongside reporting that tied the tooling to the **Buckeye/APT3** cluster. The reporting noted that attribution remained unconfirmed, with the link relying in part on collaboration with another undisclosed vendor, leaving the technical analysis more definitive than the actor assessment. Analysis of the malware showed overlapping code and strings across variants, including a **Py2Exe**-compiled Python sample and a C# payload delivered through a **PowerShell** loader. Filesnfer was described as a backconnect tool that communicates over a configured host and port and supports file upload and download, directory listing, command execution, and process enumeration, indicating its use as a flexible post-compromise implant for remote control and data access on Windows systems.
Aug 15, 2026
Researchers assessing an espionage campaign targeting East Asian companies since May 2023 said the activity likely focused on semiconductor and rare-metal sectors and used the **Xiangoop Loader** to deliver fileless payloads including **Cobalt Strike Beacon**, **EntryShell**, and in some cases **CrowDoor** through **SparrowDoor Loader**. Malware analysis found strong overlap between EntryShell and the older **KeyBoy** family, including matching embedded and encrypted strings, leading investigators to assess EntryShell as an updated KeyBoy variant. The same research identified technical overlap between **CrowDoor** and **SparrowDoor**, including identical loader shellcode and shared structural and command features, strengthening the case that **Tropic Trooper** and **FamousSparrow** are either the same threat actor or closely aligned operators. Earlier reporting on FamousSparrow described a cyberespionage group active since at least 2019 that exploited internet-facing applications such as **Microsoft Exchange** via **ProxyLogon**, **Microsoft SharePoint**, and **Oracle Opera** to deploy **SparrowDoor**, a backdoor capable of persistence, host reconnaissance, file theft, process creation, shellcode injection, and interactive remote shell access.
Aug 15, 2026
Cavalry Werewolf, an advanced persistent threat (APT) group with reported overlaps to YoroTrooper and other clusters such as SturgeonPhisher, Silent Lynx, Comrade Saiga, ShadowSilk, and Tomiris, has been actively targeting Russian state agencies and critical industries. The group has been observed deploying custom malware families, notably FoalShell and StallionRAT, in a series of sophisticated cyberattacks. According to cybersecurity vendor BI.ZONE, the attackers initiated their campaigns by sending highly targeted phishing emails that masqueraded as official correspondence from Kyrgyz government officials. These emails were crafted to deceive recipients within Russian government agencies, as well as organizations in the energy, mining, and manufacturing sectors. In some instances, the attackers compromised legitimate email accounts belonging to the Kyrgyz Republic's regulatory authority, increasing the credibility and effectiveness of their phishing attempts. The phishing emails typically contained RAR archive attachments, which, when opened, delivered the FoalShell or StallionRAT malware payloads to the victims' systems. FoalShell is a lightweight reverse shell available in Go, C++, and C# versions, enabling attackers to execute arbitrary commands via cmd.exe on compromised machines. StallionRAT, written in Go, PowerShell, and Python, provides similar capabilities, including command execution, file loading, and data exfiltration. The campaign was observed between May and August 2025, indicating a sustained and coordinated effort to infiltrate Russian public sector networks. The technical sophistication of the malware, including its multi-language implementations, suggests a well-resourced and adaptable threat actor. The use of Telegram as a command-and-control (C2) channel has also been reported, allowing the attackers to maintain covert communications and control over infected hosts. The group’s ties to Tomiris, which Microsoft has linked to a Kazakhstan-based actor known as Storm-0473, further suggest a regional nexus and possible state sponsorship. Previous related attacks by ShadowSilk targeted government entities in Central Asia and the Asia-Pacific region, using similar remote access trojans and reverse proxy tools. The ongoing campaign highlights the persistent threat posed by Cavalry Werewolf to Russian governmental and industrial targets, as well as the broader regional implications of their operations. Security researchers emphasize the importance of monitoring for phishing attempts impersonating government officials and the deployment of custom malware families like FoalShell and StallionRAT. The attacks underscore the need for robust email security, user awareness training, and advanced endpoint detection to mitigate the risk from such sophisticated APT campaigns. The incident also demonstrates the evolving tactics of threat actors in leveraging both social engineering and technical innovation to achieve their objectives. Organizations in the targeted sectors are advised to review their security postures and implement proactive threat hunting measures. The campaign serves as a reminder of the complex and dynamic nature of cyber threats facing government and critical infrastructure entities in the region.
Jun 29, 2026