Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSPlateformExploitationStealer

Also known as:French Plateform / Exploitation grabberBugatti Cloud Important/Desktop System Info.txt panel

What is the CSPlateformExploitationStealer infostealer, and what data does it steal?

CSPlateformExploitationStealer (also known as French Plateform / Exploitation grabber and Bugatti Cloud Important/Desktop System Info.txt panel) is a CyStack research label for information-stealer traces. CSPlateformExploitationStealer targets Host hardware identity (SMBIOS UUID, MachineGuid, MAC, motherboard serial, BIOS serial, processor serial, system SKU), Windows account identity (hostname, username, display name), Public and local IP addresses with ip-api.com enrichment (ISP, org, AS, country, region, city, ZIP, timezone, geo coordinates), Disk inventory (drive letter, free / total / used %, volume label) and Basic host state (OS version, CPU model, GPU adapter, RAM size, monitor count). As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSPlateformExploitationStealer is a CyStack-coined identifier for a French-developer Python-based grabber that emits a sectioned System Info.txt panel with the section headers User Pc:, System:, Peripheral:, Disk:, Serial Number:, Ip:, Ip Information:, and Ip Location:. Field labels use French tokens like Plateform (missing final e), Exploitation (French for operating system), and values include Pc Portable for laptop and Go for gigabyte. The panel writes output to an Important/Desktop/System Info.txt path inside the victim archive.

The Python builder signature is evident from two leaks: the System Bios Version field carries a Python repr(list) literal like [\'HPQOEM - 1072009\', ...] rather than a joined string, and unset WMI values render as the literal string None. Distribution is via the @Bugatti_Cloud Telegram aggregator, which is documented as a multi-family redistributor rather than a native stealer family. Family attribution is provisional pending a published threat-intel mapping for this layout.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
—	Telegram	Unknown

CSPlateformExploitationStealer Malware Analysis