CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX Installers Distributed via Compromised cpuid.com API — Threadlinqs Intelligence
As of 2026-05-30, CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX Installers Distributed via Compromised cpuid.com API is a critical-severity supply chain threat attributed to UNC-d_coroner (Russia (suspected)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 58 indicators of compromise.
Threat ID: TL-2026-0347 · Severity: CRITICAL · CVSS: 9.1 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: UNC-d_coroner · Russia (suspected) · FINANCIAL
On April 9-10, 2026, threat actors compromised a secondary API at CPUID and altered official download links on cpuid.com for approximately six hours, distributing trojanized builds of CPU-Z 2.19,
On April 9-10, 2026, an unknown threat actor compromised a ''secondary feature (side API)'' belonging to CPUID — publisher of the widely deployed hardware diagnostic utilities CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, and powerMAX — and modified the official download links on cpuid.com to randomly serve trojanized installers hosted on attacker-controlled Cloudflare R2 buckets. CPUID developer ''Doc TB'' confirmed the breach lasted approximately six hours and has been remediated; the company stated its Authenticode-signed original binaries were not compromised.
The attack chain begins when a victim downloads a trojanized archive (e.g., cpu-z_2.19-en.zip, SHA256 eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46) from the legitimate cpuid.com domain. Execution of the legitimate, CPUID-signed cpuz_x64.exe triggers a transitive DLL load through ADVAPI32.dll into CRYPTBASE.dll. Because Windows DLL search order favors the current directory, the malicious CRYPTBASE.dll shipped alongside the executable is loaded instead of the System32 copy — a textbook T1574.002 DLL sideload.
The malicious CRYPTBASE.dll is a Zig-compiled x64 PE that proxies 12 legitimate SystemFunction* exports back to the genuine CRYPTBASE.dll while spawning a worker thread that decodes 349 KB of colon-hex encoded shellcode stored in the .rdata section (total 2,041,760 bytes → 357,672 bytes decoded). The shellcode uses SIMD-accelerated Zig assembly to decode, then reflectively loads an embedded out.dll using a Stephen Fewer-style loader with ROR14 API hashing. out.dll is XXTEA-encrypted with DEFLATE compression and only activates when DllMain is called with a custom fdwReason canary value of 0x0A. The backdoor resolves welcome.supp0v3.com via DNS-over-HTTPS to Cloudflare 1.1.1.1 to evade DNS monitoring, then beacons to https://welcome.supp0v3.com/d/callback with an embedded configuration of {"tag":"tbs","referrer":"cpz","callback":"https://welcome.supp0v3.com/d/callback"}.
Follow-on C2-delivered components establish a four-layer persistence regime: (1) HKCU Run keys with randomized GUID names invoking MSBuild.exe on a C# shellcode-loader project (c_3791.proj / CommonBuild.proj) that XOR-decrypts BuildCache.dat with key 1+(i%17); (2) a hidden scheduled task with an unusual 68-minute repeat interval and 20-year duration running the same MSBuild loader at highest privileges; (3) COM TypeLib hijacking of {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} pointing to ActiveX.sct, which chains into Clippy.sct — a JScript launcher that decodes a .NET assembly encoded as an IPv6 address array, then uses BinaryFormatter deserialization to load Moniker.dll in-memory; and (4) a PowerShell profile autorun at AppData\Local\Microsoft\Windows\PowerShell\autorun.ps1.
Execution consistently pipes PowerShell through stdin using ''[Console]::In.ReadToEnd() | Invoke-Expression'' to bypass command-line logging (Event ID 4688), and in-memory C# compilation is performed via csc.exe as a LOLBin. The malware employs anti-debug checks, BIOS/memory sandbox probes, 1-2 second sleeps, and business-themed variable obfuscation ($marketManager, $customerAgent, $revenueAgent). AV classification is split between ''Backdoor.Win64.Alien,'' ''Trojan.Tedy,'' and ''Trojan.Artemis'' infostealer variants.
Infrastructure analysis reveals the C2 domain supp0v3.com was registered 2025-10-29 via ordertld.com with Cloudflare nameservers. Production C2 resolves to welcome.supp0v3.com (104.21.63.112, 172.67.145.101 Cloudflare CDN) while the staging backend ai.supp0v3.com exposes bare IP 147.45.178.61 (AS215540 Global Connectivity Solutions LLP, Frankfurt). The backend server runs Apache on port 80 and OpenSSH 9.6p1 on port 22, and presents a stolen/self-signed TLS certificate for *.vk.com (VK Kontakte, Saint Petersburg, RU). eSentire TRU correlated the same operator to STX RAT backend 95.216.51.236 (Hetzner Finland) used against FileZilla in March 2026, and to CVE-2023-36025 SmartScreen-bypass .url e
Weaknesses (CWE)
CWE-494, CWE-427, CWE-506, CWE-829
Target sectors: technology, gaming, engineering, IT, consumer, overclocking community, system administrators
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 58 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, CVE-2023-36025, T1195, T1195.002, T1189, T1059.001, T1059.007, T1204.002, T1559, T1620, T1547.001, T1053.005