ATK8

ATK8 (aka: Animal Farm, SNOWGLOBE) is a group of French origins known for its high quality malware. The group is active since at least 2009, and some of its malware have been associated with samples from as far as 2007. The group has been discovered in March 2014 after the publication of a series of slides from Edward Snowden. This group is probably supported by a state-nation, considering the fact that it uses advanced techniques but does not seem to be financially motivated. Another more precise indication makes it possible to link the group to France. For good reason, the name "Barbar" given to the group's spyware echoes a strictly French fictional character. Also, the backdoor called "Tafacalou" has a name whose meaning in Occitan French regional language is translated as:" it's gonna get hot" 

While the group is not associated with any campaign in particular, the tool it uses have been in order to target various organizations, notably in Syria, Iran and Malaysia. More broadly, the group deploys its campaigns on a global scale with some twenty countries concerned. 

The group mostly develops and use espionage tools, and the way the malware are deployed to their targets is mostly unknown, though some documents containing zero-day exploits have been used.