cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

CPUID Download Links Hijacked to Distribute Trojanized HWiNFO Installer

· Original article ↗

Summary

CPUID says attackers compromised a side API for about six hours on April 9–10, altering download links for CPU-Z and HWMonitor to serve a trojanized HWiNFO installer. The company says its signed binaries were intact and the issue is fixed.

Key points

  • Attackers altered CPUID’s official download links for CPU-Z and HWMonitor to serve a malicious file named HWiNFO_Monitor_Setup.
  • The installer used a Russian Inno Setup wrapper; researchers described a multi-stage loader that operates mostly in memory and uses NTDLL proxying from a .NET assembly.
  • CPUID said its side API was compromised for approximately six hours between April 9 and April 10, and that the issue has been fixed.
  • CPUID said its original signed binaries were not compromised; the distribution links were poisoned.
  • Researchers said the same group may have targeted FileZilla users the previous month; that connection is not confirmed.
  • Some antivirus engines classified the downloaded ZIP as Tedy or Artemis, while some researchers described the fake installer as an infostealer.

Article Details

Victim Organization
CPUID
Incident Type
Supply-chain compromise of a side API that caused official download links for CPU-Z and HWMonitor to serve a trojanized installer.
Operational Impact
CPUID said the side API was compromised for approximately six hours between April 9 and April 10, causing the website to display malicious download links. Users who downloaded during the affected period may have received malware; the number of affected downloads is not reported. CPUID said its signed original files were not compromised and that it fixed the issue.
Ransom Or Extortion
Unknown
Claim Status
confirmed

Malware

Artemis TrojanSome classify it as Tedy Trojan, and others as Artemis Trojan.Tedy TrojanSome classify it as Tedy Trojan, and others as Artemis Trojan.

Vendors

CPUIDAttackers gained access to a CPUID side API and altered official download links to serve a trojanized HWiNFO installer in place of the legitimate CPU-Z and HWMonitor binaries, exposing millions of users who downloaded

Products

CPU-ZAPI and altered official download links to serve a trojanized HWiNFO installer in place of the legitimate CPU-Z and HWMonitor binaries, exposing millions of users who downloaded from the site.HWiNFOAttackers gained access to a CPUID side API and altered official download links to serve a trojanized HWiNFO installer in place of the legitimate CPU-Z and HWMonitor binaries, exposing millions of users who downloadedHWMonitorofficial download links to serve a trojanized HWiNFO installer in place of the legitimate CPU-Z and HWMonitor binaries, exposing millions of users who downloaded from the site.