Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSBugattiUserInfoStealer

Also known as:@Bugatti_Cloud UserInformation.txt sliceBugatti hybrid Redline/Lumma/Rhadamanthys/Mars variant

What is the CSBugattiUserInfoStealer infostealer, and what data does it steal?

CSBugattiUserInfoStealer (also known as @Bugatti_Cloud UserInformation.txt slice and Bugatti hybrid Redline/Lumma/Rhadamanthys/Mars variant) is a CyStack research label for information-stealer traces. CSBugattiUserInfoStealer targets Host hardware and OS fingerprint (CPU model, GPU adapter list, installed RAM, screen resolution, Windows version), Network identity (IP address, country), Account identity (Windows username, computer name), Bot fingerprint identifiers (MachineID GUID, system product UUID) and Malware install path (Current Path field). As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSBugattiUserInfoStealer is a CyStack-coined identifier for the @Bugatti_Cloud aggregator's UserInformation.txt hybrid slice. The file is a flat Key: Value body whose vocabulary mixes markers from multiple documented stealer families. Redline contributes the Operation System: typo, ScreenSize:, and Log date: keys. Lumma contributes the # Buy now: TG operator banner template with the affiliate value stripped. Rhadamanthys contributes the MachineID: UUID bot fingerprint. Mars Stealer contributes Installed RAM: and Graphics card:. Bugatti-specific additions include CamelCase no-space UserName: / ComputerName:, a UUID: line for the system product UUID, a Current Path: label for the malware install path, and a 3-language block with spaced keys.

The @Bugatti_Cloud channel is a documented multi-family aggregator that redistributes Redline and other stealer logs in custom container formats. The mixed vocabulary observed here is consistent with an operator-side reformatter that normalises logs from multiple underlying panels into a unified template. The UserInformation.txt filename is publicly documented as Aurora Stealer's canonical exfil filename, but no public writeup publishes the exact field-label mapping. Family attribution is provisional pending a published threat-intel writeup for this layout.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

CSBugattiUserInfoStealer Malware Analysis

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
—	Telegram	Unknown

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence