EU Cyber Operations Groups

And after Russia, US, China and DPRK (North Korea), here is the one for APT groups associated with European Union (EU) nation-states. A big disclaimer here that I know that many more nation-states might be operating offensive cyber operations groups, but I only included those for which there has been some publicly known reporting associated with them.

If you think I got something wrong or there are more groups that I’m missing, please let me know and I’ll update the diagram as soon as possible.

Just like in the previous cases, the sources and changes log are available under the diagram.

Last update: 07 September 2021

Sources

• Malpedia: SNOWGLOBE
• Vice: Meet Babar, a New Malware Almost Certainly Created by France
• Wikipedia (FR): DGSE
• Wikipedia: Joint Sigint Cyber Unit
• Wikipedia: Federal Intelligence Service
• Wikipedia (ES): National Intelligence Centre
• NOS: Dutch intelligence first to alert U.S. about Russian hack of Democratic Party
• Snowden Archive: Internal NSA presentation on BND organisation
• ThaiCERT: APT group: Snowglobe, Animal Farm
• ThaiCERT: APT group: Careto, The Mask
• ESET WeLiveSecurity: Dino – the latest spying malware from an allegedly French espionage group analyzed
• GDATA: Babar: espionage software finally found and put under the microscope
• INFOSEC Institute: Animal Farm APT and the Shadow of French Intelligence
• About Intel: New hacking powers for German intelligence agencies
• Rickey Gevers: The Dutch Intelligence Agency (AIVD) hacked the Russian Cozy Bear hackers (Their Building): Here’s The Story
• Schneier on Security: “The Mask” Espionage Malware
• Kaspersky Labs: The Mask – Unveiling the World’s Most Sophisticated APT Campaign
• Légifrance: Order of 21 December 2012 on the organization of the general directorate for external security
• Zeit: BKA secretly bought NSO spyware

ChangeLog

• Version 2.0 (07 Sep. 2021): Added BKA (NSO Group customer for Pegasus spyware)
• Version 1.5 (28 April 2021): Update DGSE/STR name based on the 2012 legislation (credits: @Horgh_rce)
• Version 1.0 (28 April 2021): First publication.