Babar: espionage software finally found and put under the microscope

G DATA's analysis links EvilBunny and Babar to the SNOWGLOBE espionage operation, matching descriptions from Snowden leaks and detailing capabilities such as keystroke and clipboard logging, audio capture, screenshots, and targeted data exfiltration. The report includes hash indicators, internal project names, C2 infrastructure observations, API obfuscation techniques, and a decrypted configuration revealing targets and URLs, suggesting a sophisticated, state-sponsored espionage campaign with limited victim scope.