Threat actorRussia (suspected)Tracked since 2026-04

UNC-d_coroner

Also known as:CityOfSin operatorFileZilla masquerading group

As of 2026-05-30, UNC-d_coroner is a Russia (suspected)-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning supply chain. Also known as CityOfSin operator, FileZilla masquerading group.

Tracked threats: 11 critical
First seen: 2026-042026-04-10
Last seen: 2026-042026-04-10
ATT&CK techniques: —No mapped techniques yet
Related CVEs: 1Referenced by its activity
Attribution: Russia (suspected)Nation or origin

Nation: Russia (suspected) · 1 tracked threat(s) · Categories: SUPPLY_CHAIN

Activity timeline

UNC-d_coroner appears in 1 tracked threat between 2026-04-10 and 2026-04-10.

Tracked threats

CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX Installers Distributed via Compromised cpuid.com APICRITICAL2026-04-10

Related CVEs

1 CVE referenced by tracked UNC-d_coroner activity

CVE-2023-36025