# SNOWGLOBE: threat group profile

> SNOWGLOBE is an espionage group thought to operate from France, with suspected state backing. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.precursorintelligence.com/threat-actors/snowglobe
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > SNOWGLOBE

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Countries and victims named | 15 |
| Thought to operate from | France |
| Suspected backing | France |
| Motive | Espionage |
| Other names | 2 |
| Public reports | 7 |

## Who is SNOWGLOBE?

SNOWGLOBE is an espionage group thought to operate from France, with suspected state backing. Public reporting about it is still limited.

### Also known as

Animal Farm, ATK8

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild. Two of these zero-day vulnerabilities are associated with an advanced threat actor we call Animal Farm. Over the past few years, Animal Farm has targeted a wide range of global organizations. The group has been active since at least 2009 and there are signs that earlier malware versions  were developed as far back as 2007.

## Who does SNOWGLOBE go after?

**Sectors:** Government, Private sector

**Countries and victims named:** Syria, United States, Netherlands, Russia, Spain, Iran, China, Germany, Algeria, Norway, Malaysia, Turkey, United Kingdom, Ivory Coast, Greece

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about SNOWGLOBE

- https://securelist.com/blog/research/69114/animals-in-the-apt-farm/
- https://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france
- https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
- https://web.archive.org/web/20150218192803/http://www.cyphort.com/babar-suspected-nation-state-spyware-spotlight/
- https://www.gdatasoftware.com/blog/2015/02/24270-babar-espionage-software-finally-found-and-put-under-the-microscope
- https://www.cfr.org/interactive/cyber-operations/snowglobe
- https://resources.infosecinstitute.com/animal-farm-apt-and-the-shadow-of-france-intelligence/

## Frequently asked questions

### Who is SNOWGLOBE?

SNOWGLOBE is an espionage group thought to operate from France, with suspected state backing. Public reporting about it is still limited.

### Where is SNOWGLOBE thought to be based?

Public reporting places SNOWGLOBE as operating from France, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does SNOWGLOBE target?

In public reporting, sectors named include government and private sector, and 15 countries and victims are named, including Syria, United States, Netherlands and Russia.

### How do I know if SNOWGLOBE is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact