CPUID Website Compromise Used Trojanized CPU-Z and HWMonitor Downloads to Spread STX RAT
Summary
Unknown actors compromised CPUID’s site April 9–10, redirecting CPU-Z and HWMonitor downloads to trojanized installers that used CRYPTBASE.dll side-loading to deploy STX RAT. Kaspersky identified over 150 victims; CPUID said its signed original files were unaffected.
Key points
- CPUID said a compromise of a secondary site feature caused malicious download links to appear from about April 9 to April 10; its signed original files were unaffected.
- The replaced CPU-Z and HWMonitor downloads led to malicious sites and were distributed as ZIP archives and standalone installers.
- Trojanized packages paired legitimate signed executables with a malicious CRYPTBASE.dll that used DLL side-loading and anti-sandbox checks before fetching additional payloads.
- The campaign deployed STX RAT, which supports remote control, follow-on payload execution, desktop interaction, and infostealing.
- Kaspersky identified more than 150 victims, mostly individuals in Brazil, Russia, and China, as well as organizations in several sectors.
- The campaign reused C2 infrastructure from a prior fake FileZilla installer campaign, which Kaspersky said helped enable rapid detection.
Article Details
- Victim Organization
- CPUID
- Victim Domain
- cpuid[.]com
- Incident Type
- Website compromise used to distribute trojanized CPU-Z and HWMonitor downloads and deploy STX RAT
- Incident Date
- 2026-04-09
- Operational Impact
- CPUID's website displayed malicious download links from approximately April 9, 15:00 UTC, to April 10, 10:00 UTC. More than 150 victims were identified; CPUID said its original signed files were not affected.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cahayailmukreatif[.]web[.]id | Listed by Kaspersky as a rogue website used to distribute trojanized software. |
| DOMAIN | pub-45c2577dbd174292a02137c18e7b1b5a[.]r2[.]dev | Listed by Kaspersky as a rogue website used to distribute trojanized software. |
| DOMAIN | transitopalermo[.]com | Listed by Kaspersky as a rogue website used to distribute trojanized software. |
| DOMAIN | vatrobran[.]hr | Listed by Kaspersky as a rogue website used to distribute trojanized software. |
MITRE ATT&CK
T1105 · Ingress Tool TransferThe malicious DLL contacted an external server and executed additional payloads.T1497.001 · System ChecksThe malicious DLL performed anti-sandbox checks before executing additional payloads.T1574.002 · DLL Side-LoadingThe trojanized installers used a malicious CRYPTBASE.dll for DLL side-loading.
Malware
Products
CPU-ZUnknown threat actors briefly compromised CPUID’s website (cpuid[.]com) and replaced download links for CPU-Z and HWMonitor with trojanized installers to serve malicious executables.HWMonitorUnknown threat actors briefly compromised CPUID’s website (cpuid[.]com) and replaced download links for CPU-Z and HWMonitor with trojanized installers to serve malicious executables.
Countries
BrazilKaspersky identified more than 150 victims, mostly individuals in Brazil, Russia, and China, plus organizations in multiple sectors; poor attacker opsec allowed rapid detection.ChinaKaspersky identified more than 150 victims, mostly individuals in Brazil, Russia, and China, plus organizations in multiple sectors; poor attacker opsec allowed rapid detection.RussiaKaspersky identified more than 150 victims, mostly individuals in Brazil, Russia, and China, plus organizations in multiple sectors; poor attacker opsec allowed rapid detection.
Industries
AgricultureHowever, organizations in retail, manufacturing, consulting, telecommunications, and agriculture have also been impacted.ConsultingHowever, organizations in retail, manufacturing, consulting, telecommunications, and agriculture have also been impacted.ManufacturingHowever, organizations in retail, manufacturing, consulting, telecommunications, and agriculture have also been impacted.RetailHowever, organizations in retail, manufacturing, consulting, telecommunications, and agriculture have also been impacted.TelecommunicationsHowever, organizations in retail, manufacturing, consulting, telecommunications, and agriculture have also been impacted.