Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSBugattiPcInfoStealer Infostealer Analysis: Targets & TTPs

CSBugattiPcInfoStealer

Also known as:@Bugatti_Cloud pc_info.txt sliceBugatti operator-normalized Acreed-adjacent variant

What is the CSBugattiPcInfoStealer infostealer, and what data does it steal?

CSBugattiPcInfoStealer (also known as @Bugatti_Cloud pc_info.txt slice and Bugatti operator-normalized Acreed-adjacent variant) is a CyStack research label for information-stealer traces. CSBugattiPcInfoStealer targets Host hardware and OS fingerprint (CPU cores, RAM, GPU, screen resolution, Windows version and architecture), Network identity (IP address, country) and Account identity (Windows username, computer name). As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSBugattiPcInfoStealer is a CyStack-coined identifier for the @Bugatti_Cloud aggregator's pc_info.txt bare-key text slice. The file is a flat Key: Value body whose vocabulary resembles the publicly documented Acreed pc_info.json key set but with operator-side renames throughout: PcName becomes Computer Name, Arch becomes Architecture, CpuCores becomes Cores, ScreenSize becomes Resolution. The panel also emits a duplicate Display Resolution: line with an empty value on the line just before the populated Resolution: key, and the HWID: value is a Computer-Name-prefixed UUID composite rather than a bare UUID or hex blob.

The @Bugatti_Cloud channel is a documented multi-family aggregator that redistributes Redline and other stealer logs in a custom container format. This pc_info.txt variant may be an operator-normalized text output of Acreed data or a different underlying builder's panel; the renamed vocabulary is too far from documented Acreed JSON to attribute directly. Family attribution is provisional pending a published threat-intel mapping for this exact text layout.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
bu********	Telegram	Unknown

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`61bbdb0...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1IP: <value>2Country: <value>3HWID: <value>4OS: <value>5Architecture: <value>6UserName: <value>7Computer Name: <value>8Local Time: <value>9Cores: <value>10RAM: <value>11Display Resolution:12Resolution: <value>13GPU: