CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX Installers Distributed via Compromised cpuid.com API

CPUID Supply Chain Compromise (TL-2026-0347), also tracked as CPUID Compromise, is a critical-severity supply-chain compromise scored CVSS 9.1, first published 2026-04-10. It is attributed to UNC-d_coroner (Russia) with medium confidence, affects CPUID CPU-Z, references 1 CVE (CVE-2023-36025), maps to 30 MITRE ATT&CK techniques (T1027, T1036.005, T1053.005), and is covered by 9 detection rules and 58 indicators of compromise.

Key facts for TL-2026-0347

Threat ID
TL-2026-0347
Also known as
CPUID Compromise, supp0v3 Campaign, CityOfSin, Backdoor.Win64.Alien, Trojan.Tedy
Severity
CRITICAL
CVSS
9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-04-10
Last reviewed
2026-04-10
Attribution
UNC-d_coroner
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
technology, gaming, engineering, IT, consumer, overclocking community, system administrators
Target regions
Global, North America, Europe, Asia
Detection rules
9
Indicators of compromise
58

Malware and tooling in CPUID Supply Chain Compromise

Malware and tooling: Backdoor.Win64.Alien / Trojan.Tedy / Trojan.Artemis, Backdoor.Win64.Alien (Zig-compiled, custom) + STX RAT (linked infrastructure)

On April 9-10, 2026, threat actors compromised a secondary API at CPUID and altered official download links on cpuid.com for approximately six hours, distributing trojanized builds of CPU-Z 2.19, HWMonitor 1.63, HWMonitor Pro 1.57, PerfMonitor 2, and powerMAX. The malicious bundles abuse DLL sideloading via a Zig-compiled CRYPTBASE.dll proxy that reflectively loads an encrypted PE backdoor communicating with welcome.supp0v3.com over DNS-over-HTTPS. The same threat actor was previously linked to a March 2026 FileZilla masquerading campaign and a CVE-2023-36025 SmartScreen-bypass operation.

How CPUID Supply Chain Compromise works

On April 9-10, 2026, an unknown threat actor compromised a ''secondary feature (side API)'' belonging to CPUID — publisher of the widely deployed hardware diagnostic utilities CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, and powerMAX — and modified the official download links on cpuid.com to randomly serve trojanized installers hosted on attacker-controlled Cloudflare R2 buckets. CPUID developer ''Doc TB'' confirmed the breach lasted approximately six hours and has been remediated; the company stated its Authenticode-signed original binaries were not compromised.

The attack chain begins when a victim downloads a trojanized archive (e.g., cpu-z_2.19-en.zip, SHA256 eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46) from the legitimate cpuid.com domain. Execution of the legitimate, CPUID-signed cpuz_x64.exe triggers a transitive DLL load through ADVAPI32.dll into CRYPTBASE.dll. Because Windows DLL search order favors the current directory, the malicious CRYPTBASE.dll shipped alongside the executable is loaded instead of the System32 copy — a textbook T1574.002 DLL sideload.

The malicious CRYPTBASE.dll is a Zig-compiled x64 PE that proxies 12 legitimate SystemFunction* exports back to the genuine CRYPTBASE.dll while spawning a worker thread that decodes 349 KB of colon-hex encoded shellcode stored in the .rdata section (total 2,041,760 bytes → 357,672 bytes decoded). The shellcode uses SIMD-accelerated Zig assembly to decode, then reflectively loads an embedded out.dll using a Stephen Fewer-style loader with ROR14 API hashing. out.dll is XXTEA-encrypted with DEFLATE compression and only activates when DllMain is called with a custom fdwReason canary value of 0x0A. The backdoor resolves welcome.supp0v3.com via DNS-over-HTTPS to Cloudflare 1.1.1.1 to evade DNS monitoring, then beacons to https://welcome.supp0v3.com/d/callback with an embedded configuration of {"tag":"tbs","referrer":"cpz","callback":"https://welcome.supp0v3.com/d/callback"}.

Follow-on C2-delivered components establish a four-layer persistence regime: (1) HKCU Run keys with randomized GUID names invoking MSBuild.exe on a C# shellcode-loader project (c_3791.proj / CommonBuild.proj) that XOR-decrypts BuildCache.dat with key 1+(i%17); (2) a hidden scheduled task with an unusual 68-minute repeat interval and 20-year duration running the same MSBuild loader at highest privileges; (3) COM TypeLib hijacking of {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} pointing to ActiveX.sct, which chains into Clippy.sct — a JScript launcher that decodes a .NET assembly encoded as an IPv6 address array, then uses BinaryFormatter deserialization to load Moniker.dll in-memory; and (4) a PowerShell profile autorun at AppData\Local\Microsoft\Windows\PowerShell\autorun.ps1.

Execution consistently pipes PowerShell through stdin using ''[Console]::In.ReadToEnd() | Invoke-Expression'' to bypass command-line logging (Event ID 4688), and in-memory C# compilation is performed via csc.exe as a LOLBin. The malware employs anti-debug checks, BIOS/memory sandbox probes, 1-2 second sleeps, and business-themed variable obfuscation ($marketManager, $customerAgent, $revenueAgent). AV classification is split between ''Backdoor.Win64.Alien,'' ''Trojan.Tedy,'' and ''Trojan.Artemis'' infostealer variants.

Infrastructure analysis reveals the C2 domain supp0v3.com was registered 2025-10-29 via ordertld.com with Cloudflare nameservers. Production C2 resolves to welcome.supp0v3.com (104.21.63.112, 172.67.145.101 Cloudflare CDN) while the staging backend ai.supp0v3.com exposes bare IP 147.45.178.61 (AS215540 Global Connectivity Solutions LLP, Frankfurt). The backend server runs Apache on port 80 and OpenSSH 9.6p1 on port 22, and presents a stolen/self-signed TLS certificate for *.vk.com (VK Kontakte, Saint Petersburg, RU). eSentire TRU correlated the same operator to STX RAT backend 95.216.51.236 (Hetzner Finland) used against FileZilla in March 2026, and to CVE-2023-36025 SmartScreen-bypass .url exploit activity dating back to 2025-09-19 targeting LibreOffice and Google Drive WebDAV lures. The threat actor handle @d_coroner was observed in VBS payload headers, with campaign identifier ''CityOfSin'' appearing in C2 utm_source parameters.

At the time of disclosure (2026-04-10), cpuid.com has rotated the compromised links and restored clean signed binaries, but the attacker-controlled Cloudflare R2 buckets and the welcome.supp0v3.com C2 channel remain live and responsive. Anyone who downloaded CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, or powerMAX from cpuid.com between approximately April 3 and April 10, 2026 should treat their host as potentially compromised, hunt for CRYPTBASE.dll outside System32, enumerate the COM TypeLib hijack and scheduled-task persistence, and re-image if indicators are present.

MITRE ATT&CK techniques used in TL-2026-0347

defense-evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.004 File Deletion; T1127.001 MSBuild; T1140 Deobfuscate/Decode Files or Information; T1218.010 Regsvr32; T1497 Virtualization/Sandbox Evasion

execution

T1053.005 Scheduled Task; T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File; T1559 Inter-Process Communication

command-and-control

T1071.004 DNS; T1090.002 External Proxy; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.002 Asymmetric Cryptography

discovery

T1082 System Information Discovery

initial-access

T1189 Drive-by Compromise; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain

privilege-escalation

T1546.013 PowerShell Profile; T1546.015 Component Object Model Hijacking; T1548.002 Bypass User Account Control

persistence

T1547.001 Registry Run Keys / Startup Folder; T1574.001 DLL

resource-development

T1583.001 Domains; T1584.006 Web Services

stealth

T1620 Reflective Code Loading

Affected products and versions in CPUID Supply Chain Compromise

  • CPUID — CPU-Z
    Vulnerable versions: 2.19 (trojanized zip from cpuid.com 2026-04-09/10)
    Fixed in: 2.19 clean signed build (post 2026-04-10)
  • CPUID — HWMonitor
    Vulnerable versions: 1.63 (trojanized zip from cpuid.com 2026-04-09/10)
    Fixed in: 1.63 clean signed build (post 2026-04-10)
  • CPUID — HWMonitor Pro
    Vulnerable versions: 1.57 (trojanized zip and Inno Setup exe 2026-04-09/10)
    Fixed in: 1.57 clean signed build (post 2026-04-10)
  • CPUID — PerfMonitor 2
    Vulnerable versions: 2.04 (trojanized 2026-04-09/10)
    Fixed in: 2.04 clean signed build (post 2026-04-10)
  • CPUID — powerMAX
    Vulnerable versions: 1.00 (trojanized 2026-04-08/10)
    Fixed in: 1.00 clean signed build (post 2026-04-10)

Remediation for CPUID Supply Chain Compromise

Patches

  • Re-download CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, and powerMAX from cpuid.com after 2026-04-10 (clean binaries restored by CPUID)
  • Verify Authenticode signature on cpuz_x64.exe and hwmonitor.exe before running

Immediate actions

  • Block domain supp0v3.com and all subdomains (welcome, ai, helloworld, elcome) at DNS/firewall/proxy
  • Block Cloudflare R2 buckets pub-45c2577dbd174292a02137c18e7b1b5a.r2.dev, pub-fd67c956bf8548b7b2cc23bb3774ff0c.r2.dev, pub-f3252d8370f34f0d9f3b3c427d3ac33c.r2.dev
  • Block outbound to 147.45.178.61 (AS215540 Global Connectivity Solutions LLP) and 95.216.51.236 (Hetzner)
  • Alert on and restrict DNS-over-HTTPS (DoH) traffic to 1.1.1.1/dns-query from endpoints
  • Quarantine any CRYPTBASE.dll or version.dll file located outside C:\Windows\System32\
  • Hunt for files matching the SHA256 list in section IOCs across EDR telemetry

Workarounds

  • Temporarily use Microsoft Sysinternals Coreinfo, HWiNFO (distinct vendor), or vendor-provided BIOS reporting instead of CPU-Z/HWMonitor until trust is re-established
  • Where possible, obtain CPU-Z and HWMonitor from Microsoft Store or major software repositories rather than direct vendor downloads

Longer-term hardening

  • Deploy EDR with behavioral detection for DLL sideloading, reflective PE loading, and MSBuild LOLBin execution
  • Enforce application allowlisting to restrict MSBuild.exe, csc.exe, cvtres.exe, regsvcs.exe, and regsvr32.exe execution to developer tiers
  • Enable PowerShell Script Block Logging (EID 4104) and Module Logging to capture stdin-piped PowerShell payloads not visible in EID 4688
  • Monitor HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} and HKCU\...\Run entries for unauthorized modifications
  • Implement egress DNS policy that blocks or inspects DoH providers
  • Require Authenticode verification before executing any third-party utility; maintain a trusted hash allowlist for CPU-Z, HWMonitor, and similar diagnostic tools
  • Train users to verify vendor signatures even when downloading from official sites during high-risk disclosure windows

CVEs associated with CPUID Supply Chain Compromise

CVE-2023-36025

Weaknesses (CWE) in CPUID Supply Chain Compromise

CWE-494, CWE-427, CWE-506, CWE-829

Timeline of CPUID Supply Chain Compromise

  • First CVE-2023-36025 SmartScreen-bypass .url exploit (LibreOffice lure) observed on VirusTotal — earliest known activity of the operator later tied to the CPUID campaign.
  • Domain supp0v3.com registered via ordertld.com with Cloudflare nameservers; ai.supp0v3.com activated pointing to bare IP 147.45.178.61 (AS215540, Frankfurt).
  • Minimal 34 KB CRYPTBASE.dll variant (SHA256 74b5d631...) submitted to VirusTotal bundled with a trojanized MEXC exchange installer — the earliest CRYPTBASE.dll observed from this operator.
  • welcome.supp0v3.com activated behind Cloudflare (104.21.63.112, 172.67.145.101) as the production C2 callback endpoint.
  • FileZilla-themed version.dll sideload variant (362 KB) first observed on VirusTotal — precursor campaign linked by eSentire TRU to STX RAT backend 95.216.51.236 (Hetzner, Finland).
  • CPUID officially Authenticode-signs CPU-Z 2.19 — the version whose installer the attackers later trojanize.
  • Trojanized powermax_1.00.zip (with PDF lure) created and staged in attacker Cloudflare R2 bucket pub-45c2577dbd174292a02137c18e7b1b5a.r2.dev.
  • Attackers compromise a secondary CPUID API and alter official download links on cpuid.com to randomly serve trojanized CPU-Z 2.19 and HWMonitor 1.63 builds hosted on attacker R2 buckets. Trojanized ZIPs first seen on VirusTotal (e.g., eff5ece6...).
  • At time of disclosure the supp0v3.com C2 channel, Cloudflare R2 distribution buckets, and 147.45.178.61 backend remain live and responsive; VBS payloads are still being served from the backend and the R2 bucket is still serving trojanized cpu-z_2.19-en.zip.
  • Redditors and security researchers publicly report CPU-Z and HWMonitor downloads flagging on VirusTotal and renaming to HWiNFO_Monitor_Setup.exe. BleepingComputer, Cybernews, Igor''s LAB, PCGamer, and CyberInsider publish coverage. CPUID developer ''Doc TB'' confirms the ~6-hour compromise of a secondary API and states the issue has been fixed; clean signed binaries restored.
  • As of 2026-05-29, the CPUID download vector is contained (signed binaries restored within ~6h), but the threat stays live: the STX RAT / supp0v3 operator runs persistent, reused C2 infrastructure (active since 2025, 150+ victims, campaigns tbs/tbs2/tbs3/snip) with no reported takedown, sinkhole, or arrest, and CVE-2023-36025 remains in CISA KEV and exploited.

Sources cited for CPUID Supply Chain Compromise

Threats related to CPUID Supply Chain Compromise

Detection coverage for TL-2026-0347

As of 2026-04-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0347 across Splunk SPL, Microsoft KQL and Sigma, covering 58 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats