CPUID Breach: STX RAT Delivered via Trojanized CPU-Z & HWMonitor Downloads

CPUID is the developer behind CPU-Z and HWMonitor — free diagnostic utilities used by tens of millions of PC enthusiasts, IT professionals, system administrators, and OEM hardware vendors globally. Between April 9, 2026 at approximately 15:00 UTC and April 10, 2026 at approximately 10:00 UTC — a window of roughly 19 hours — the official CPUID download page was compromised.

According to CPUID contributor Samuel Demeulemeester (Doc TB), who acknowledged the breach publicly on X: "A secondary feature (basically a side API) was compromised for approximately six hours between April 9 and April 10, causing the main website to randomly display malicious links (our signed original files were not compromised). The breach was found and has since been fixed."

The download links were poisoned via the compromised API to redirect to attacker-controlled infrastructure — specifically Cloudflare R2 storage buckets and several other attacker-controlled domains. The original CPUID signed binaries were never modified; the attack lived entirely in the redirect chain and the malicious packages served from external infrastructure.

Community detection began when Reddit user DMkiIIer posted to r/pcmasterrace after downloading what appeared to be HWMonitor 1.63 and receiving a VirusTotal-flagged file named "HWiNFO_Monitor_Setup.exe" with a Russian-language installer. The post quickly gained traction, and tech creator Chris Titus Tech (@christitustech) amplified it with the warning "Millions about to be PWNED!" — triggering rapid community and vendor response. The timing of the attack was notable: CPUID founder Franck Delattre was on leave, and Demeulemeester had been working on Memtest86+ through the night when the breach was discovered.

Breakglass Intelligence noted that cpuid.com runs Apache 2.4.59/2.4.66, versions affected by 34 known CVEs. The most probable candidate for initial access is CVE-2024-38475 — an Apache HTTP Server mod_rewrite path traversal vulnerability that allows an attacker to map URLs to filesystem locations not intended to be served, potentially exposing server-side scripts or CMS backend configuration. With write access to the CMS backend, the attacker could modify download links to point to the Cloudflare R2 staging bucket.

The compromised CPUID download page redirected users to the following attacker-controlled domains. All were confirmed by Kaspersky's analysis:

The malicious package, distributed as both a ZIP archive and a standalone installer (e.g., HWiNFO_Monitor_Setup.exe), contained two components: a legitimate signed CPUID executable for the corresponding product and a malicious DLL named CRYPTBASE.dll. An immediate red flag noted by community researchers: the Inno Setup installer presented Russian-language dialogs — CPUID is a French company.

CYDERES confirmed the malicious CRYPTBASE.dll carries a timestomped compilation timestamp set to 2077-08-31 05:16:43 — a deliberate artifact to hinder timeline analysis and forensic correlation.

Windows DLL search order means that when HWMonitor_x64.exe (or any CPUID executable) launches, Windows searches the application's own directory before system directories. Since the malicious CRYPTBASE.dll is placed in the same directory as the legitimate executable, it is loaded first — sideloading the attacker's DLL without any explicit exploit. CRYPTBASE.dll is also the name of a legitimate Windows system library, making this a living-off-the-land technique that bypasses application whitelisting trusting the signed parent.

Upon execution within DllMain, the malware spawns a separate thread which initiates an additional thread responsible for executing the primary malicious payload — this multi-threaded approach is used to release the loader lock. Concurrently, it loads the legitimate cryptbase.dll from System32 and returns TRUE to prevent a deadlock condition, ensuring the target application appears to function normally.

Before initiating the unpacking chain, the malware sends JSON-formatted victim metadata to the hardcoded C2 domain welcome[.]supp0v3[.]com for victim tracking. The configuration embedded in the DLL includes campaign tags. CYDERES identified four active campaign tags and two referrer values:

After the malicious DLL is sideloaded, it initiates a five-stage unpacking chain. Each stage decrypts and reflectively loads the next — entirely in memory. This produces zero on-disk artifacts after Stage 1, making forensic recovery and static detection extremely difficult. CYDERES Howler Cell documented the complete chain:

STX RAT was first documented by eSentire's Threat Response Unit (TRU) on April 8, 2026, after observing an attempted delivery in a customer environment in the Finance industry in late February 2026. The name derives from its use of the Start of Text (STX) magic byte "\x02" prefixed to all C2 messages. The malware's FileZilla campaign vector was separately documented by Malwarebytes in early March 2026.

The packer is characterized by two exports named "init" and "run", with XXTEA decryption / Zlib decompression on a byte array in the .DATA section. Following tail jumps is effective for unpacking the core payload.

Strings are obfuscated via two mechanisms: (1) rolling XOR-encoding where the key index advances per byte and wraps at a predefined modulus — for example, key starting at 0x39, incrementing, wrapping at 0x6C — and (2) AES-128-CTR encryption via CryptDecrypt API, stored in a table with the structure: AES key (16 bytes) + nonce (5 bytes) + ciphertext length (DWORD) + ciphertext. Strings are decrypted on demand and deleted from memory immediately after use.

STX RAT performs extensive pre-execution checks. On detection of any virtualization artifact, the malware jitter-exits (sleeps with a randomized delay and exits). Hypervisors checked include:

The malware implements AMSI Ghosting — patching the Windows API rpcrt4!NdrClientCall3 to disable a core RPC layer that AMSI depends on, preventing security solutions from acting on AMSI telemetry. The window is also hidden from Alt+Tab and the Taskbar by targeting the "CASCADIA_HOSTING_WINDOW_CLASS" (Windows Terminal class name) and adding WS_EX_TOOLWINDOW.

STX RAT's C2 protocol is sophisticated. Communication occurs over TCP (C2: 95[.]216[.]51[.]236:31415 — a non-standard port) with the following cryptographic stack:

The introduction message sent to C2 includes: user_id, machine_id, hostname, username, OS, malware build version, architecture, admin status, PID, process path, server address, UTM campaign tracking (utm_group, utm_source from clipboard regex), RAM, and AV list. The C2 responds with either a get_creds command (triggers credential theft immediately) or an update command if the malware version is considered outdated. The C2 also supports: die, run, start_hvnc, start_tunnel, and full HVNC keyboard/mouse injection commands.

The malware also supports Tor as a fallback C2 via a custom Tor client implementation. Onion address: yu7sbzk2tgm4vv56qgvsq44wnwgct6sven4akbb2n3onp46f42fcstid.onion