Afternoon Review in IT Security — April 13, 2026

The afternoon security landscape reflects an evolving threat environment characterized by supply chain compromises, sophisticated social engineering campaigns, architectural vulnerabilities in cloud infrastructure, and ongoing law enforcement actions against cybercriminal enterprises. These developments underscore the persistent challenges organizations face across multiple attack vectors and threat actor sophistication levels.

CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads

A Russian-speaking threat actor has successfully compromised CPUID's download infrastructure, replacing legitimate distribution links with malicious versions of popular system monitoring tools. The attack leveraged the trusted reputation of CPU-Z and HWMonitor to deliver STX RAT, a recently emerged remote access trojan that grants attackers unauthorized system access. This supply chain attack represents a significant threat to users who rely on these widely-used utilities for hardware diagnostics and monitoring. Source: CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads

North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

The North Korean advanced persistent threat group APT37, also tracked as ScarCruft, has executed a multi-stage social engineering campaign targeting users through Facebook. The threat actors built trust relationships by adding targets as friends on the social media platform before transitioning to malware delivery. The campaign distributes RokRAT, a remote access trojan designed to provide attackers with control over compromised systems. This approach demonstrates how nation-state actors exploit the inherent trust mechanisms of social platforms to establish initial access. Source: North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

Why Your Deprecated Endpoints Are an Attacker's Best Friend: The Rise of Ghost APIs

Organizations face an emerging architectural vulnerability through ghost APIs, which are deprecated endpoints that remain active within systems despite no longer serving legitimate business functions. Unlike shadow APIs that operate outside organizational awareness, ghost APIs represent forgotten infrastructure that continues to expose systems to attack. Threat actors exploit these endpoints through discovery techniques, victim identity gathering, and exploitation of public-facing applications, creating hidden security risks that traditional security assessments may overlook. Source: Why Your Deprecated Endpoints Are an Attacker's Best Friend: The Rise of Ghost APIs

Alleged German DDoS-for-Hire Kingpin Behind Fluxstress Caught in Thailand

Law enforcement has apprehended an alleged German cybercriminal in Thailand who operated Fluxstress and Neldowner, prominent DDoS-for-hire platforms that provided distributed denial-of-service attack services to global customers. The arrest concludes years of investigation into the suspect's operation of these criminal services across multiple countries. This enforcement action highlights both the international nature of cybercriminal enterprises and the ongoing efforts by law enforcement agencies to disrupt organized cybercrime infrastructure. Source: Alleged German DDoS-for-Hire Kingpin Behind Fluxstress Caught in Thailand

Today's threat landscape demonstrates that security challenges span from supply chain compromises and social engineering to architectural vulnerabilities and criminal infrastructure operations. Organizations must maintain vigilance across software distribution channels, employee awareness regarding social engineering tactics, API inventory management, and threat intelligence regarding evolving attack capabilities.