SNOWGLOBE
No sourced public emblem in this profile.
reference profile · reported nexus: FR (not nationality)
In 2014, researchers at Kaspersky Lab discovered and reported on three zero-days that were being used in cyberattacks in the wild. Two of these zero-day vulnerabilities are associated with an advanced threat actor we call Animal Farm. Over the past few years, Animal Farm has targeted a wide range of global organizations. The group has been active since at least 2009 and there are signs that earlier malware versions were developed as far back as 2007.
Source-reported aliases: Animal Farm, Snowglobe, ATK8. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
Syria · 
United States of America · 
Netherlands · 
Russia · 
Spain · 
Iran · 
China · 
Germany · 
Algeria · 
Norway · 
Malaysia · 
Türkiye · 
United Kingdom · 
Côte d'Ivoire · 
Greece
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://securelist.com/blog/research/69114/animals-in-the-apt-farm/
https://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france
https://www.cfr.org/interactive/cyber-operations/snowglobe
https://resources.infosecinstitute.com/animal-farm-apt-and-the-shadow-of-france-intelligence/