CSBabaCloudStealer is a CyStack tracking name for a
Vidar-shaped System_Info.txt distributed by the
@BabaCloud_New Telegram channel operator. Victim folders
follow the shape @BabaCloud_New {<seq>} [<CC>]_<IPv4>_ <HWID8>_<DDMMYYYY>_<HHMMSS> and ship inside archives
named @BabaCloudNew { <count> } Logs Cloud <DDMMYYYY>.rar.
The body carries the Vidar-canonical identifier preamble
(MachineID, GUID, HWID, Path, Work Dir, Windows,
Computer Name, User Name, Display Resolution) plus the
Vidar-canonical five-field hardware tuple (Processor,
Cores, Threads, RAM, VideoCard) that public reporting
documents as Vidar's own build-4.x+ schema. The rebrand
strips Version, Install date, AV, Display Language,
Keyboard Languages, Local Time, TimeZone, and the
trailing [Processes] and [Software] sections.
Distinctive presentation differences vs the canonical Vidar
body: every field uses a space-before-colon form
(Key : Value), the harvest wall clock is split across
adjacent Date : and Time : lines instead of a single
combined value, the hardware block is introduced by a
--- [ Hardware ] --- dash-boxed header rather than a bare
[Hardware] bracket header, and absent-path victims carry a
Path : >- YAML-block-scalar sentinel. The framing banner
is an angle-bracket sandwiched caret block advertising
Main Channel - @Baba_Logs, Public Logs Channel : @BabaCloud_New, Public Ulp Channel : @BabaUlp_New, and
Admin : @Mr_Ghost_004 between two horizontal rules.
Public reporting attests @BabaCloud_New as a
Telegram-distributed cloud-logs operation that has released
multiple thousand-record credential dumps since mid-2025 but
does not explicitly name the underlying panel family. The
Vidar attribution here is inferred from the identifier
preamble plus the five-field hardware tuple - a combination
that is Vidar-canonical - and is retained at medium
confidence pending an explicit rebrand mapping.
This tracking name is unrelated to the CSBabaStealer
profile, which covers a .B.A.B.A. Lumma-rebrand distributed
by a different operator; the shared Baba substring in the
names is incidental.
