CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX Installers Distributed via Compromised cpuid.com API

Key facts

Detection coverage

As of 2026-04-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0347 across Splunk SPL, Microsoft KQL and Sigma, covering 58 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Alien Backdoor C2 Beacon to welcome.supp0v3.com — Command and Control

Detects network connections and proxy/DNS traffic to the supp0v3.com C2 infrastructure and known backend IPs (147.45.178.61 AS215540, 104.21.63.112/172.67.145.101 Cloudflare, 95.216.51.236 Hetzner STX RAT) used by the CPUID supply chain backdoor. Catches both the HTTPS beacon to /d/callback and the DoH resolver pivot to 1.1.1.1 with the supp0v3.com query name.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1071.004, T1090, T1568.002
• Data sources: proxy, zeek, firewall, microsoft_defender_for_endpoint, dns
• Severity: critical
• Confidence: high

Splunk SPL

(index=proxy OR index=zeek OR index=firewall OR sourcetype="stream:http" OR sourcetype="bro:http:json") (dest="welcome.supp0v3.com" OR dest="*.supp0v3.com" OR url="*supp0v3.com*" OR http_host="*supp0v3.com*" OR dest_ip IN (147.45.178.61, 104.21.63.112, 172.67.145.101, 95.216.51.236))
| eval c2_family=case(like(dest,"%supp0v3.com") OR like(url,"%supp0v3.com%"),"supp0v3_alien", dest_ip="147.45.178.61","supp0v3_backend_ai", dest_ip="95.216.51.236","stx_rat_hetzner", 1=1,"supp0v3_cloudflare")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources values(user) as users values(url) as urls values(http_host) as hosts by c2_family, dest_ip
| table c2_family dest_ip sources users urls hosts count first_seen last_seen

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "supp0v3.com" or RemoteIP in ("147.45.178.61","104.21.63.112","172.67.145.101","95.216.51.236")
| extend c2_family = case(RemoteUrl has "supp0v3.com","supp0v3_alien", RemoteIP=="147.45.178.61","supp0v3_backend_ai", RemoteIP=="95.216.51.236","stx_rat_hetzner","supp0v3_cloudflare")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, c2_family

Sigma

title: Network Beacon To supp0v3.com C2 Infrastructure (CPUID Supply Chain)
id: 9a8f2c4d-7e31-4c8a-bb21-cpuid347c2x1
status: experimental
description: Detects Alien backdoor C2 traffic to welcome.supp0v3.com / *.supp0v3.com and the associated backend infrastructure used in the April 2026 CPUID supply chain compromise (TL-2026-0347).
references:
    - https://intel.threadlinqs.com/threats/TL-2026-0347
author: Threadlinqs Team
date: 2026/04/10
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1071.004
    - attack.t1090
logsource:
    category: proxy
detection:
    selection_domain:
        c-uri|contains: 'supp0v3.com'
    selection_host:
        cs-host|contains: 'supp0v3.com'
    selection_ip:
        dst_ip:
            - '147.45.178.61'
            - '95.216.51.236'
    condition: 1 of selection_*
falsepositives:
    - None expected. supp0v3.com is operator-controlled infrastructure with no legitimate use.
level: critical

Known false positives:

• None expected — supp0v3.com is attacker-owned; any match should be treated as high-confidence.

Tuning notes: Push domain and IP IOCs into your TI platform so proxy logs alert in real time. For Cloudflare fronting IPs (104.21.63.112, 172.67.145.101) require the hostname to match supp0v3.com — those IPs front legitimate Cloudflare traffic. Pair with JA3/JA4 fingerprint of the Alien beacon and the embedded JSON callback body tag 'tbs' for higher fidelity.

• 🔒 MDE — CPUID Utility Loading Unsigned [indicator] From Working Directory · unlock with TL Creds
• 🔒 MDE — Scheduled Task With 68-Minute Repeat + HKCU Run Registry Persistence · unlock with TL Creds
• 🔒 MDE — [indicator] C2 Beacon and DoH Resolver Pivot · unlock with TL Creds
• 🔒 Sigma — [indicator] Loaded From Non-System Directory · unlock with TL Creds
• 🔒 Sigma — Scheduled Task With 68-Minute Repeat And 20-Year Duration · unlock with TL Creds
• 🔒 Sigma — DNS-over-HTTPS Request To Cloudflare From Non-Browser Process · unlock with TL Creds
• 🔒 [indicator] Sideloaded by CPUID Utilities — Exploitation Phase · unlock with TL Creds
• 🔒 MSBuild Loader Executing .proj From User AppData — Post-Exploitation Persistence · unlock with TL Creds

Indicators of compromise

As of 2026-04-10, Threadlinqs Intelligence tracks 58 indicators of compromise for TL-2026-0347.

Sample indicators (3 of 58)

• IP address: 147.45.178[.]61
• Domain: supp0v3[.]com
• File hash: eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46

Defanged, TLP:CLEAR. Full set of 58 indicators: unlock with TL Creds.

Technical analysis

The same threat actor was previously linked to a March 2026 FileZilla masquerading campaign and a CVE-2023-36025 SmartScreen-bypass operation.

On April 9-10, 2026, an unknown threat actor compromised a ''secondary feature (side API)'' belonging to CPUID — publisher of the widely deployed hardware diagnostic utilities CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, and powerMAX — and modified the official download links on cpuid.com to randomly serve trojanized installers hosted on attacker-controlled Cloudflare R2 buckets. CPUID developer ''Doc TB'' confirmed the breach lasted approximately six hours and has been remediated; the company stated its Authenticode-signed original binaries were not compromised.

The attack chain begins when a victim downloads a trojanized archive (e.g., cpu-z_2.19-en.zip, SHA256 eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46) from the legitimate cpuid.com domain. Execution of the legitimate, CPUID-signed cpuz_x64.exe triggers a transitive DLL load through ADVAPI32.dll into CRYPTBASE.dll. Because Windows DLL search order favors the current directory, the malicious CRYPTBASE.dll shipped alongside the executable is loaded instead of the System32 copy — a textbook T1574.002 DLL sideload.

The malicious CRYPTBASE.dll is a Zig-compiled x64 PE that proxies 12 legitimate SystemFunction* exports back to the genuine CRYPTBASE.dll while spawning a worker thread that decodes 349 KB of colon-hex encoded shellcode stored in the .rdata section (total 2,041,760 bytes → 357,672 bytes decoded). The shellcode uses SIMD-accelerated Zig assembly to decode, then reflectively loads an embedded out.dll using a Stephen Fewer-style loader with ROR14 API hashing. out.dll is XXTEA-encrypted with DEFLATE compression and only activates when DllMain is called with a custom fdwReason canary value of 0x0A. The backdoor resolves welcome.supp0v3.com via DNS-over-HTTPS to Cloudflare 1.1.1.1 to evade DNS monitoring, then beacons to https://welcome.supp0v3.com/d/callback with an embedded configuration of {"tag":"tbs","referrer":"cpz","callback":"https://welcome.supp0v3.com/d/callback"}.

Follow-on C2-delivered components establish a four-layer persistence regime: (1) HKCU Run keys with randomized GUID names invoking MSBuild.exe on a C# shellcode-loader project (c_3791.proj / CommonBuild.proj) that XOR-decrypts BuildCache.dat with key 1+(i%17); (2) a hidden scheduled task with an unusual 68-minute repeat interval and 20-year duration running the same MSBuild loader at highest privileges; (3) COM TypeLib hijacking of {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} pointing to ActiveX.sct, which chains into Clippy.sct — a JScript launcher that decodes a .NET assembly encoded as an IPv6 address array, then uses BinaryFormatter deserialization to load Moniker.dll in-memory; and (4) a PowerShell profile autorun at AppData\Local\Microsoft\Windows\PowerShell\autorun.ps1.

Execution consistently pipes PowerShell through stdin using ''[Console]::In.ReadToEnd() | Invoke-Expression'' to bypass command-line logging (Event ID 4688), and in-memory C# compilation is performed via csc.exe as a LOLBin. The malware employs anti-debug checks, BIOS/memory sandbox probes, 1-2 second sleeps, and business-themed variable obfuscation ($marketManager, $customerAgent, $revenueAgent). AV classification is split between ''Backdoor.Win64.Alien,'' ''Trojan.Tedy,'' and ''Trojan.Artemis'' infostealer variants.

Infrastructure analysis reveals the C2 domain supp0v3.com was registered 2025-10-29 via ordertld.com with Cloudflare nameservers. Production C2 resolves to welcome.supp0v3.com (104.21.63.112, 172.67.145.101 Cloudflare CDN) while the staging backend ai.supp0v3.com exposes bare IP 147.45.178.61 (AS215540 Global Connectivity Solutions LLP, Frankfurt). The backend server runs Apache on port 80 and OpenSSH 9.6p1 on port 22, and presents a stolen/self-signed TLS certificate for *.vk.com (VK Kontakte, Saint Petersburg, RU). eSentire TRU correlated the same operator to STX RAT backend 95.216.51.236 (Hetzner Finland) used against FileZilla in March 2026, and to CVE-2023-36025 SmartScreen-bypass .url exploit activity dating back to 2025-09-19 targeting LibreOffice and Google Drive WebDAV lures. The threat actor handle @d_coroner was observed in VBS payload headers, with campaign identifier ''CityOfSin'' appearing in C2 utm_source parameters.

At the time of disclosure (2026-04-10), cpuid.com has rotated the compromised links and restored clean signed binaries, but the attacker-controlled Cloudflare R2 buckets and the welcome.supp0v3.com C2 channel remain live and responsive. Anyone who downloaded CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, or powerMAX from cpuid.com between approximately April 3 and April 10, 2026 should treat their host as potentially compromised, hunt for CRYPTBASE.dll outside System32, enumerate the COM TypeLib hijack and scheduled-task persistence, and re-image if indicators are present.

MITRE ATT&CK techniques by tactic:

defense-evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.004 File Deletion; T1127.001 MSBuild; T1140 Deobfuscate/Decode Files or Information; T1218.010 Regsvr32; T1497 Virtualization/Sandbox Evasion

execution

T1053.005 Scheduled Task; T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File; T1559 Inter-Process Communication

command-and-control

T1071.004 DNS; T1090.002 External Proxy; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.002 Asymmetric Cryptography

discovery

T1082 System Information Discovery

initial-access

T1189 Drive-by Compromise; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain

privilege-escalation

T1546.013 PowerShell Profile; T1546.015 Component Object Model Hijacking; T1548.002 Bypass User Account Control

persistence

T1547.001 Registry Run Keys / Startup Folder; T1574.001 DLL

resource-development

T1583.001 Domains; T1584.006 Web Services

stealth

T1620 Reflective Code Loading

Remediation

Patches

• Re-download CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, and powerMAX from cpuid.com after 2026-04-10 (clean binaries restored by CPUID)
• Verify Authenticode signature on cpuz_x64.exe and hwmonitor.exe before running

Immediate actions

• Block domain supp0v3.com and all subdomains (welcome, ai, helloworld, elcome) at DNS/firewall/proxy
• Block Cloudflare R2 buckets pub-45c2577dbd174292a02137c18e7b1b5a.r2.dev, pub-fd67c956bf8548b7b2cc23bb3774ff0c.r2.dev, pub-f3252d8370f34f0d9f3b3c427d3ac33c.r2.dev
• Block outbound to 147.45.178.61 (AS215540 Global Connectivity Solutions LLP) and 95.216.51.236 (Hetzner)
• Alert on and restrict DNS-over-HTTPS (DoH) traffic to 1.1.1.1/dns-query from endpoints
• Quarantine any CRYPTBASE.dll or version.dll file located outside C:\Windows\System32\
• Hunt for files matching the SHA256 list in section IOCs across EDR telemetry

Workarounds

• Temporarily use Microsoft Sysinternals Coreinfo, HWiNFO (distinct vendor), or vendor-provided BIOS reporting instead of CPU-Z/HWMonitor until trust is re-established
• Where possible, obtain CPU-Z and HWMonitor from Microsoft Store or major software repositories rather than direct vendor downloads

Longer-term hardening

• Deploy EDR with behavioral detection for DLL sideloading, reflective PE loading, and MSBuild LOLBin execution
• Enforce application allowlisting to restrict MSBuild.exe, csc.exe, cvtres.exe, regsvcs.exe, and regsvr32.exe execution to developer tiers
• Enable PowerShell Script Block Logging (EID 4104) and Module Logging to capture stdin-piped PowerShell payloads not visible in EID 4688
• Monitor HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} and HKCU\...\Run entries for unauthorized modifications
• Implement egress DNS policy that blocks or inspects DoH providers
• Require Authenticode verification before executing any third-party utility; maintain a trusted hash allowlist for CPU-Z, HWMonitor, and similar diagnostic tools
• Train users to verify vendor signatures even when downloading from official sites during high-risk disclosure windows

Affected and fixed versions

• CPUID — CPU-Z
  Vulnerable versions: 2.19 (trojanized zip from cpuid.com 2026-04-09/10)
  Fixed in: 2.19 clean signed build (post 2026-04-10)
• CPUID — HWMonitor
  Vulnerable versions: 1.63 (trojanized zip from cpuid.com 2026-04-09/10)
  Fixed in: 1.63 clean signed build (post 2026-04-10)
• CPUID — HWMonitor Pro
  Vulnerable versions: 1.57 (trojanized zip and Inno Setup exe 2026-04-09/10)
  Fixed in: 1.57 clean signed build (post 2026-04-10)
• CPUID — PerfMonitor 2
  Vulnerable versions: 2.04 (trojanized 2026-04-09/10)
  Fixed in: 2.04 clean signed build (post 2026-04-10)
• CPUID — powerMAX
  Vulnerable versions: 1.00 (trojanized 2026-04-08/10)
  Fixed in: 1.00 clean signed build (post 2026-04-10)

Timeline

• 2025-09-19 First CVE-2023-36025 SmartScreen-bypass .url exploit (LibreOffice lure) observed on VirusTotal — earliest known activity of the operator later tied to the CPUID campaign.
• 2025-10-29 Domain locked-ioc-49 registered via ordertld.com with Cloudflare nameservers; locked-ioc-43 activated pointing to bare IP locked-ioc-46 (AS215540, Frankfurt).
• 2025-11-27 Minimal 34 KB locked-ioc-45 variant (SHA256 74b5d631...) submitted to VirusTotal bundled with a trojanized MEXC exchange installer — the earliest locked-ioc-45 observed from this operator.
• 2025-12-11 locked-ioc-40 activated behind Cloudflare (locked-ioc-47, locked-ioc-44) as the production C2 callback endpoint.
• 2025-12-31 FileZilla-themed version.dll sideload variant (362 KB) first observed on VirusTotal — precursor campaign linked by eSentire TRU to STX RAT backend locked-ioc-48 (Hetzner, Finland).
• 2026-03-16 CPUID officially Authenticode-signs CPU-Z 2.19 — the version whose installer the attackers later trojanize.
• 2026-04-08 Trojanized powermax_1.00.zip (with PDF lure) created and staged in attacker Cloudflare R2 bucket locked-ioc-32.
• 2026-04-09 Attackers compromise a secondary CPUID API and alter official download links on cpuid.com to randomly serve trojanized CPU-Z 2.19 and HWMonitor 1.63 builds hosted on attacker R2 buckets. Trojanized ZIPs first seen on VirusTotal (e.g., eff5ece6...).
• 2026-04-10 At time of disclosure the locked-ioc-49 C2 channel, Cloudflare R2 distribution buckets, and locked-ioc-46 backend remain live and responsive; VBS payloads are still being served from the backend and the R2 bucket is still serving trojanized cpu-z_2.19-en.zip.
• 2026-04-10 Redditors and security researchers publicly report CPU-Z and HWMonitor downloads flagging on VirusTotal and renaming to locked-ioc-38. BleepingComputer, Cybernews, Igor''s LAB, PCGamer, and CyberInsider publish coverage. CPUID developer ''Doc TB'' confirms the ~6-hour compromise of a secondary API and states the issue has been fixed; clean signed binaries restored.
• 2026-05-29 As of 2026-05-29, the CPUID download vector is contained (signed binaries restored within ~6h), but the threat stays live: the STX RAT / supp0v3 operator runs persistent, reused C2 infrastructure (active since 2025, 150+ victims, campaigns tbs/tbs2/tbs3/snip) with no reported takedown, sinkhole, or arrest, and CVE-2023-36025 remains in CISA KEV and exploited.

Sources cited

• CVE-2023-36025 Windows SmartScreen Security Feature Bypass NVD (NIST) · Advisory · 2023-11-14
• CPU-Z 2.19 Supply Chain Attack Analysis — Trojanized DLL Sideloading with Zig-compiled CRYPTBASE.dll GitHub · Research · 2026-04-10
• VirusTotal — eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46 virustotal.com · Research · 2026-04-09
• CPUID Website Compromised to Deliver Weaponized HWMonitor and CPU-Z Tools cryptika.com · Blog · 2026-04-10
• Supply chain attack at CPUID pushes malware with CPU-Z/HWMonitor BleepingComputer · News · 2026-04-10
• CPUID compromised, HWMonitor and CPU-Z delivered malware cybernews.com · News · 2026-04-10
• Warning: CPUID Suspected of Being a Virus; Suspicious HWMonitor Downloads Raise Alarms igorslab.de · News · 2026-04-10
• The official download for CPU-Z and HWMonitor has been hacked pcgamer.com · News · 2026-04-10
• HWMonitor and CPU-Z downloads hijacked to deliver malware to users cyberinsider.com · News · 2026-04-10
• Breach has been fixed, says CPUID, after CPU-Z and HWMonitor flagged as malware pcguide.com · News · 2026-04-10
• VideoCardz: CPU-Z and HWMonitor installers on CPUID site flagged for malware videocardz.com · News · 2026-04-10

Related threats

Previous and next in supply chain

• Smart Slider 3 Pro Supply Chain Compromise — Malicious WordPress and Joomla Plugin Updates with Multi-Layered Backdoors (v3.5.1.35) Previous report
• Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) Reaches OpenAI macOS Signing Pipeline, Forces Apple Certificate Rotation — DPRK UNC1069 / Sapphire Sleet WAVESHAPER.V2 Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages