* o SNOWGLOBE: From Discovery to Attribution. Overall Classification: TOP SECRET II COMINT II REL TO CAN, AUS. GBR, NZL, USA. l + l UNCLASSIFIED 1

Transcription

1 l + l Overall Classification: TOP SECRET II COMINT II REL TO CAN, AUS. GBR, NZL, USA Communications Security Centre de la sécurité * o SNOWGLOBE: From Discovery to Attribution Safeguarding Canada's security through information superiority Préserver la sécurité du Canada par la supériorité de l'information Canada UNCLASSIFIED 1

2 l + l Overall Classification: TOP SECRET II COMINT II REL TO CAN, AUS. GBR, NZL, USA Communications Security Centre de la sécurité VICTIMOLOGY Discovery Development (Victimology Attribution SNOWGLOBE Questions Safeguarding Canada's security through information superiority f ^ Q V l ^ f V ^ t Préserver la sécurité du Canada par la supériorité de l'information Vy<xl I d U d UNCLASSIFIED 14

3 Overall Classification: TOP SECRET II COMINT I! REL TO CAN, AUS, GBR, NZL, USA I I Communications Security Centre de la sécurité Victimology: Iran Iranian M FA Iran University of Science and Technology I. Atomic Energy Organization of Iran Data Communications of Iran Iranian Research Organization for Science Technology, Imam Hussein University Malek-E-Ashtar University Safeguardi^TQl-BisSEO]R T /^COMIÎsJT // REL TO CAN, AUS, r^anarla Préserver ^ ^ Vydl l(lc_ld

4 Overall Classification: TOP SECRET II COMINT II REL TO CAN, AUS, GBR, NZL, USA Communications Security / Centre de la sécurité Victimology: Global Five Eyes - Possible targeting of a French-language Canadian media organization Europe - Greece Possibly associated with European Financial Association - France - Norway - Spain Africa - Ivory Coast - Algeria SafeguardiïîTQ)i?JaSjEGRJEX /L.COMXMrT // REL TO CAN, AUS, PanQ/llQ Préserver la sécurité du.canada, par la supériorité de l'information V y d l l d U a

5 l + l Overall Classification: TOP SECRET II COMINT II REL TO CAN, AUS. GBR, NZL, USA Communications Security Centre de la sécurité ATTRIBUTION Discovery Development Victimology Attribution SNOWGLOBE Questions Safeguarding Canada's security through information superiority Préserver la sécurité du Canada par la supériorité de l'information Canada UNCLASSIFIED 17

6 Overall Classification: TOP SECRET II COMINT II REL TO CAN, AUS, GBR, NZL, USA Communications Security / Centre de la sécurité Attribution: Binary Artifacts ntrass.exe - DLL Loader uploaded to a victim as part of tasking seen in collection - Internal Name: Babar - Developer username: titi Babar is a popular French children's television show Titi is a French diminutive for Thiery, or a colloquial term for a small person SafeguardinTQlixlaSMGjRaET // QQMINT // REL TO CAN, AUS, franarla Préserver la sécurité du Canada parla suoériorité de l'information vyd.1 lclqcl

7 Communications Security Establishment Canada Overall Classification: TOP SECRET II COMINT II REL TO CAN, AUS, GBR, NZL, USA Centre de la sécurité des télécommunications Canada Attribution: Intelligence Priorities Iranian science and technology - Notably, the Atomic Energy Organization of Iran - Nuclear research European supranational organizations - European Financial Association Former French colonies - Algeria, Ivory Coast French-speaking organizations/areas - French-language media organization Doesn't fit cybercrime profile

8 La traque de Babar 7 Pages - Contributed by Martin Untersinger, Le Monde - Mar 21, 2014 Information: sensibles ip Nous avons choisi de ne publier qlïune partie du doctrinent sur lequel nous avons tfavahlé. ce dernier contenant des informations relatives a tine operaiiondt reneeigtismer* p-ot-entil&tn-&nl encore en coure. M&dias canadiens (p, 4) - Possible targeting of a French-ianguage Canadian media organization Des media s canadiens francop hones pourraient faire partie des victimes du programme inalveillant. DLL ([>. DLL Loader uptoaded to a victim as * ft s'agit ici d'un programme t*ie comprimante de- "Snowglofce". conçu pou être inséré dans l'ordinateur de la cible

9 Priorités (p. 7) Attribution: intelligence Priorities Sir celte page. I«C-5EC résume les cibles de "Snbowglobe" pour enf-aire apparaître les principales prioriés.