Cybersecurity — 2026-04-14
CPUID Website Breach Distributes STX RAT Trojan via Trojanized CPU-Z and HWMonitor Downloads
Unknown threat actors compromised cpuid.com for approximately 19 hours on April 9-10, replacing download links for CPU-Z and HWMonitor with malicious versions containing the STX RAT remote access trojan. The attackers exploited a secondary API to redirect downloads. Kaspersky identified over 150 victims across retail, manufacturing, telecom, and agriculture sectors. The C2 infrastructure matches a prior campaign that trojanized FileZilla installers, suggesting a persistent threat actor reusing tooling.
Analysis
C2 infrastructure matching a prior trojanized FileZilla campaign fingers an established actor with deliberate focus on developer and admin tooling, not an opportunist. The 150-victim count (per Kaspersky) across retail, manufacturing, telecom, and agriculture, drawn from a 19-hour window, raises a plausible alternative: this was targeted against a known CPUID user list rather than a broad spray. The reuse of tooling and targeting of widely-installed diagnostics utilities signals a persistent supply chain doctrine worth tracking.
C2 infrastructure matching a prior trojanized FileZilla campaign fingers an established actor with deliberate focus on developer and admin tooling, not an opportunist. The 150-victim count (per Kaspersky) across retail, manufacturing, telecom, and agriculture, drawn from a 19-hour window, raises a plausible alternative: this was targeted against a known CPUID user list rather than a broad spray. The reuse of tooling and targeting of widely-installed diagnostics utilities signals a persistent supply chain doctrine worth tracking.
2 sources
- CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads -
The Hacker News - Hackers hijacked CPUID downloads, served STX RAT to victims -
Help Net Security