CPUID Website Compromise Served Trojanized Hardware-Utility Downloads
Summary
A compromised CPUID side API reportedly served trojanized hardware utilities. Kaspersky identified over 150 victims; malicious installers used DLL sideloading to deliver STX RAT, which can steal credentials and other information.
Key points
- CPUID’s maintainer said a compromised side API caused the website to randomly display links to trojanized CPU-Z, HWMonitor, and PerfMonitor downloads; the original files were unaffected.
- Kaspersky reported that malicious installers also included HWMonitor Pro and identified over 150 victims, mostly individuals as well as organizations in several sectors.
- Attackers distributed ZIP archives and standalone installers that bundled legitimate software with a malicious cryptbase.dll loaded through DLL sideloading.
- The payload was STX RAT, which can give attackers control of infected machines and steal browser credentials, cryptocurrency wallets, and FTP passwords.
- CPUID’s maintainer said the compromise lasted about six hours on April 10; Kaspersky observed a longer window, from April 9 to April 10.
- Breakglass Intelligence linked the incident to a broader campaign involving trojanized FileZilla software and said evidence suggested the CPUID attack began April 3.
Article Details
- Victim Organization
- CPUID
- Incident Type
- Website compromise used to distribute trojanized software installers and STX RAT in a supply-chain and watering-hole attack.
- Data Types Exposed
- Browser credentials (targeted for theft by STX RAT; actual theft not reported)
- Cryptocurrency wallets (targeted for theft by STX RAT; actual theft not reported)
- FTP client passwords (targeted for theft by STX RAT; actual theft not reported)
- Affected Records
- Kaspersky identified over 150 victims; the number of affected records was not disclosed.
- Affected Data Size
- Unknown
- Operational Impact
- The CPUID website served links to trojanized CPU-Z, HWMonitor, and PerfMonitor downloads. The compromised installers delivered legitimate software alongside cryptbase.dll, which was loaded via DLL sideloading to install STX RAT. CPUID's maintainer said the compromise lasted roughly six hours; Kaspersky observed a longer compromise window.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
Malware
Vendors
Products
CPU-ZThe CPUID website, popular in the PC hardware community, was recently hacked and altered to deliver malicious versions of CPU-Z, HWMonitor, and PerfMonitor.HWMonitorThe CPUID website, popular in the PC hardware community, was recently hacked and altered to deliver malicious versions of CPU-Z, HWMonitor, and PerfMonitor.HWMonitor ProKaspersky has also analyzed this supply chain and watering hole attack, noting that during the compromise window the CPUID website served malicious installers for CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor.PerfMonitorThe CPUID website, popular in the PC hardware community, was recently hacked and altered to deliver malicious versions of CPU-Z, HWMonitor, and PerfMonitor.
Countries
BrazilKaspersky saw most infections in Brazil, China, and Russia, but it’s worth noting that the company has limited visibility in North America and Europe.ChinaKaspersky saw most infections in Brazil, China, and Russia, but it’s worth noting that the company has limited visibility in North America and Europe.RussiaKaspersky saw most infections in Brazil, China, and Russia, but it’s worth noting that the company has limited visibility in North America and Europe.
Industries
AgricultureThe security firm has identified over 150 victims, mostly individuals but also organizations in sectors such as manufacturing, retail, telecoms, consulting, and agriculture.ConsultingThe security firm has identified over 150 victims, mostly individuals but also organizations in sectors such as manufacturing, retail, telecoms, consulting, and agriculture.ManufacturingThe security firm has identified over 150 victims, mostly individuals but also organizations in sectors such as manufacturing, retail, telecoms, consulting, and agriculture.RetailThe security firm has identified over 150 victims, mostly individuals but also organizations in sectors such as manufacturing, retail, telecoms, consulting, and agriculture.