Cybercriminals targeted CPUID (“cpuid[.]com”), the official website for well-known hardware monitoring programs like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor. For nearly a day, they used the site to distribute infected versions of the software, installing a remote access trojan known as STX RAT.

The security breach occurred between roughly April 9, 15:00 UTC, and April 10, 10:00 UTC. During this time, the download links for CPU-Z and HWMonitor were redirected to malicious websites.

CPUID acknowledged the incident in an online statement, stating that a vulnerability in a “secondary feature (basically a side API)” caused the main site to occasionally display malicious links. Importantly, the attack did not affect the original, digitally signed files.

According to Kaspersky, the fake download websites included:

• cahayailmukreatif.web[.]id
• pub-45c2577dbd174292a02137c18e7b1b5a.r2[.]dev
• transitopalermo[.]com
• vatrobran[.]hr

“The compromised software was distributed both as ZIP files and as regular installers for the programs mentioned,” the cybersecurity firm explained. “These files contained a legitimate, signed executable of the software, alongside a malicious DLL file named ‘CRYPTBASE.dll’ used for DLL side-loading.”

The malicious DLL connects to an external server to download additional payloads, first attempting to evade detection by performing anti-sandbox checks. The ultimate goal of the attack is to install STX RAT, a remote access trojan that includes HVNC capabilities and can steal a wide range of information.

eSentire’s analysis of the malware last week noted that STX RAT “offers a comprehensive set of commands for remote control, subsequent payload deployment, and post-exploitation activities (such as in-memory execution of EXE/DLL/PowerShell/shellcode, reverse proxy/tunneling, and desktop interaction).”

The command-and-control (C2) server address and connection details were the same as those used in a previous attack involving infected FileZilla installers hosted on fake sites to distribute the same STX RAT malware. Malwarebytes reported on this activity earlier in the month.

Kaspersky reported identifying over 150 victims, mostly individuals, who were affected. However, organizations in the retail, manufacturing, consulting, telecommunications, and agriculture industries were also targeted. Most infections were located in Brazil, Russia, and China.

“The most significant error the attackers made was reusing the same STX RAT infection chain and C2 domain names from the previous campaign involving fake FileZilla installers,” Kaspersky stated. “The attacker’s overall malware development, deployment, and operational security capabilities are relatively weak, which allowed for rapid detection of the watering hole compromise.”