Threat Intelligence / Actor / UNC-d_coroner (CityOfSin campaign)

UNC-d_coroner (CityOfSin campaign)

Nation: Russia (suspected) · 1 tracked threat(s) · Categories: SUPPLY_CHAIN

Also known as: @d_coroner, CityOfSin operator, FileZilla masquerading group, supp0v3 operator

Tracked threats

CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX Installers Distributed via Compromised cpuid.com API — CRITICAL

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence