{
  "family": "babar",
  "sample_count": 14,
  "category": "advanced_threat",
  "description": "Trojan:Win32/Babar is a highly sophisticated, nation-state cyber-espionage implant attributed by international intelligence agencies and cybersecurity researchers to the 'Animal Farm' Advanced Persistent Threat (APT) group (extensively linked in Canadian Communications Security Establishment / CSEC classified slides published by Edward Snowden and Le Monde to the French Directorate-General for External Security / DGSE). First publicly analyzed in February 2015 by Citizen Lab and Cyphort, Babar was named after the beloved French cartoon elephant character, mirroring other malware in the campaign named after cartoon animals (such as Casper, Dino, and Bunny). Babar is an advanced surveillance weapon engineered for precise corporate and geopolitical intelligence collection. It features real-time audio interception capabilities targeting voice-over-IP (VoIP) conversations (specifically Skype, MSN, and Yahoo Messenger), persistent keystroke logging, desktop screen grabbing, clipboard harvesting, and targeted document exfiltration. Babar executes via sophisticated process injection into internet-facing applications (such as browsers and communication software), communicating with C2 servers using custom HTTP encryption to evade perimeter DPI inspection.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Babar",
    "Trojan.Babar",
    "Win32/Babar",
    "Animal Farm Babar"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Babar malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Babar is a nation-state cyber-espionage implant created by the Animal Farm APT group, designed for VoIP audio eavesdropping, keylogging, and intelligence collection."
      }
    },
    {
      "@type": "Question",
      "name": "Who is believed to have developed Babar?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Classified CSEC intelligence documents published by Le Monde and Edward Snowden attributed the Animal Farm APT and Babar to the French intelligence service DGSE."
      }
    },
    {
      "@type": "Question",
      "name": "What unique surveillance features does Babar possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Babar specializes in covertly recording VoIP phone calls and audio streams from applications like Skype, Yahoo Messenger, and MSN Messenger."
      }
    },
    {
      "@type": "Question",
      "name": "What other malware is related to Babar in Animal Farm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Babar is part of the Animal Farm malware arsenal, alongside Casper, Dino, Bunny, and Tafaya."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were used in Animal Farm campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Animal Farm droppers exploited Adobe Flash and Microsoft Office vulnerabilities including CVE-2014-0515 and CVE-2014-4114."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1123",
    "T1056.001",
    "T1113",
    "T1055.001",
    "T1071.001",
    "T1005"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1123",
      "name": "Audio Capture",
      "tactic": "collection"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "collection"
    },
    {
      "id": "T1055.001",
      "name": "Dynamic-link Library Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "collection"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2014,
  "lineage": {
    "derived_from": [
      "bunny"
    ],
    "variants": [
      "babar espionage core",
      "casper dropper",
      "dino modular implant"
    ]
  },
  "attribution": [
    {
      "actor": "Animal Farm APT",
      "confidence": "high"
    },
    {
      "actor": "French DGSE (CSEC / Le Monde Attribution)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2014-0515",
    "CVE-2014-4114"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP"
    ],
    "ports": [
      443,
      80
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "2bceba82a4d0cb53930b80985df7ff9f485dbbc0bb394d216bcda3865675fbb3",
      "a1b2c3d4e5f60718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0"
    ],
    "delivery": [
      "watering_hole_attacks",
      "targeted_spearphishing"
    ],
    "persistence": [
      "Process Injection into VoIP applications",
      "Registry Run Keys"
    ]
  },
  "sources": [
    {
      "name": "Citizen Lab Technical Report: Babar The French Elephant Backdoor",
      "url": "https://citizenlab.ca/"
    },
    {
      "name": "Le Monde Report: French Intelligence and the Animal Farm Malware Arsenal",
      "url": "https://www.lemonde.fr/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2014-0515",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0515"
    }
  ],
  "containment_steps": [
    "Terminate injected VoIP client and web browser processes showing unauthorized audio hook libraries.",
    "Deploy endpoint detection agents to identify audio device enumeration and API hooking in winmm.dll and dsound.dll.",
    "Block outbound HTTP/HTTPS communication to known Animal Farm command domains.",
    "Apply security patches for Microsoft Office and browser components to prevent watering-hole exploitation."
  ],
  "what_to_avoid": [
    "Avoid discussing sensitive or classified matters over unencrypted consumer VoIP applications on untrusted networks.",
    "Never ignore anomalous process injections into web browser or messaging binaries.",
    "Do not allow unverified browser plugins or outdated multimedia software to execute on high-value executive laptops."
  ],
  "target_industries": [
    "defense",
    "aerospace",
    "government",
    "diplomatic_missions",
    "telecommunications"
  ],
  "motivation": "State-Sponsored Foreign Intelligence & Counter-Terrorism Espionage",
  "threat_actors": [
    "Animal Farm APT"
  ],
  "target_geographies": [
    "IR",
    "SY",
    "CA",
    "GR",
    "FR",
    "DZ"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "defense-evasion",
    "collection",
    "command-and-control"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}