CSBabaCloudInfoStealer is a CyStack-coined identifier for
a third @BabaCloud_New-repackaged System_Info.txt body
shape observed alongside the sibling Vidar-shape and
BuildBlock-shape distributions from the same operator.
The body is a bare Key: Value block with verbose
Redline-shape field names (Execution Path,
Computer Name, Installed RAM, Operation System sic
typo, Processor split into Processor Threads /
Processor Cores, Graphics Card header with the GPU
model on the next indented line) followed by a blank line
and a spaced-colon trailer footer carrying IP Address:,
Time :, Country :, and User: values that the peer
sibling Info shapes strip entirely.
Observed inside @BabaCloud_New { <count>+ } Cloud Logs <DD>.<MM>.<YYYY>.7z aggregator packs at
@BabaCloud_New {<seq>} [<CC>]_<IPv4>_<HWIDPFX>_<8-digit>_ <6-digit>/System_Info.txt victim folders. Field vocabulary
is byte-identical to the peer CSFateTrafficInfoStealer,
CSRoyCloudInfoStealer, and CSForzaTrafficStealer
Info-family profiles; only the surrounding aggregator
wrapping (archive-path self-watermark, trailer footer
presence, in-body banner) differs between the sibling
profiles.
Public reporting attests @BabaCloud_New as a Telegram
cloud-logs operation that has released multiple
thousand-record credential dumps since mid-2025 but does
not name the underlying panel family for either its
Vidar-shape, BuildBlock-shape, or Info-shape
distributions. The verbose bare-KV Info-family panel
builder itself is unattested by any surveyed curated CTI
vendor. Family stays CyStack-coined with the
@BabaCloud_New distribution channel preserved as
attribution context; rename the profile if a published
threat-intel mapping surfaces.
