# CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX Installers Distributed via Compromised cpuid.com API > On April 9-10, 2026, threat actors compromised a secondary API at CPUID and altered official download links on cpuid.com for approximately six hours, distributing trojanized builds of CPU-Z 2.19, HWMonitor 1.63, HWMonitor Pro 1.57, PerfMonitor 2, and powerMAX. The malicious bundles abuse DLL sideloading via a Zig-compiled CRYPTBASE.dll proxy that reflectively loads an encrypted PE backdoor communicating with welcome.supp0v3.com over DNS-over-HTTPS. The same threat actor was previously linked to a March 2026 FileZilla masquerading campaign and a CVE-2023-36025 SmartScreen-bypass operation. - **Published:** 2026-04-10T12:00:00Z - **Last reviewed:** 2026-04-10T12:00:00Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0347 - **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-cpuid-download-hijack-tl-2026-0347.webp?v=52e6cb94 (Threadlinqs threat intel: CPUID CPU-Z 2.19 Trojanized Installers: Detection & IOCs (TL-2026-0347) — Critical severity, 58 IOCs, 9 detection rules.) - **ID:** TL-2026-0347 - **Severity:** CRITICAL (CVSS 9.1) - **Category:** SUPPLY_CHAIN - **Status:** MONITORING - **Actor:** UNC-d_coroner (Russia) - **Detections:** 9 (1 shown free below) · **IOCs:** 58 (3 shown free below) - **CVEs:** CVE-2023-36025 ## Description On April 9-10, 2026, an unknown threat actor compromised a ''secondary feature (side API)'' belonging to CPUID — publisher of the widely deployed hardware diagnostic utilities CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, and powerMAX — and modified the official download links on cpuid.com to randomly serve trojanized installers hosted on attacker-controlled Cloudflare R2 buckets. CPUID developer ''Doc TB'' confirmed the breach lasted approximately six hours and has been remediated; the company stated its Authenticode-signed original binaries were not compromised. The attack chain begins when a victim downloads a trojanized archive (e.g., cpu-z_2.19-en.zip, SHA256 eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46) from the legitimate cpuid.com domain. Execution of the legitimate, CPUID-signed cpuz_x64.exe triggers a transitive DLL load through ADVAPI32.dll into CRYPTBASE.dll. Because Windows DLL search order favors the current directory, the malicious CRYPTBASE.dll shipped alongside the executable is loaded instead of the System32 copy — a textbook T1574.002 DLL sideload. The malicious CRYPTBASE.dll is a Zig-compiled x64 PE that proxies 12 legitimate SystemFunction* exports back to the genuine CRYPTBASE.dll while spawning a worker thread that decodes 349 KB of colon-hex encoded shellcode stored in the .rdata section (total 2,041,760 bytes → 357,672 bytes decoded). The shellcode uses SIMD-accelerated Zig assembly to decode, then reflectively loads an embedded out.dll using a Stephen Fewer-style loader with ROR14 API hashing. out.dll is XXTEA-encrypted with DEFLATE compression and only activates when DllMain is called with a custom fdwReason canary value of 0x0A. The backdoor resolves welcome.supp0v3.com via DNS-over-HTTPS to Cloudflare 1.1.1.1 to evade DNS monitoring, then beacons to https://welcome.supp0v3.com/d/callback with an embedded configuration of {"tag":"tbs","referrer":"cpz","callback":"https://welcome.supp0v3.com/d/callback"}. Follow-on C2-delivered components establish a four-layer persistence regime: (1) HKCU Run keys with randomized GUID names invoking MSBuild.exe on a C# shellcode-loader project (c_3791.proj / CommonBuild.proj) that XOR-decrypts BuildCache.dat with key 1+(i%17); (2) a hidden scheduled task with an unusual 68-minute repeat interval and 20-year duration running the same MSBuild loader at highest privileges; (3) COM TypeLib hijacking of {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} pointing to ActiveX.sct, which chains into Clippy.sct — a JScript launcher that decodes a .NET assembly encoded as an IPv6 address array, then uses BinaryFormatter deserialization to load Moniker.dll in-memory; and (4) a PowerShell profile autorun at AppData\Local\Microsoft\Windows\PowerShell\autorun.ps1. Execution consistently pipes PowerShell through stdin using ''[Console]::In.ReadToEnd() | Invoke-Expression'' to bypass command-line logging (Event ID 4688), and in-memory C# compilation is performed via csc.exe as a LOLBin. The malware employs anti-debug checks, BIOS/memory sandbox probes, 1-2 second sleeps, and business-themed variable obfuscation ($marketManager, $customerAgent, $revenueAgent). AV classification is split between ''Backdoor.Win64.Alien,'' ''Trojan.Tedy,'' and ''Trojan.Artemis'' infostealer variants. Infrastructure analysis reveals the C2 domain supp0v3.com was registered 2025-10-29 via ordertld.com with Cloudflare nameservers. Production C2 resolves to welcome.supp0v3.com (104.21.63.112, 172.67.145.101 Cloudflare CDN) while the staging backend ai.supp0v3.com exposes bare IP 147.45.178.61 (AS215540 Global Connectivity Solutions LLP, Frankfurt). The backend server runs Apache on port 80 and OpenSSH 9.6p1 on port 22, and presents a stolen/self-signed TLS certificate for *.vk.com (VK Kontakte, Saint Petersburg, RU). eSentire TRU correlated the same operator to STX RAT backend 95.216.51.236 (Hetzner Finland) used against FileZilla in March 2026, and to CVE-2023-36025 SmartScreen-bypass .url exploit activity dating back to 2025-09-19 targeting LibreOffice and Google Drive WebDAV lures. The threat actor handle @d_coroner was observed in VBS payload headers, with campaign identifier ''CityOfSin'' appearing in C2 utm_source parameters. At the time of disclosure (2026-04-10), cpuid.com has rotated the compromised links and restored clean signed binaries, but the attacker-controlled Cloudflare R2 buckets and the welcome.supp0v3.com C2 channel remain live and responsive. Anyone who downloaded CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, or powerMAX from cpuid.com between approximately April 3 and April 10, 2026 should treat their host as potentially compromised, hunt for CRYPTBASE.dll outside System32, enumerate the COM TypeLib hijack and scheduled-task persistence, and re-image if indicators are present. ## MITRE ATT&CK - T1195 Supply Chain Compromise - T1195.002 Compromise Software Supply Chain - T1189 Drive-by Compromise - T1059.001 PowerShell - T1059.007 JavaScript - T1204.002 Malicious File - T1559 Inter-Process Communication - T1620 Reflective Code Loading - T1547.001 Registry Run Keys / Startup Folder - T1053.005 Scheduled Task - T1546.015 Component Object Model Hijacking - T1546.013 PowerShell Profile - T1574.001 DLL - T1027 Obfuscated Files or Information - T1140 Deobfuscate/Decode Files or Information - T1070.004 File Deletion - T1497 Virtualization/Sandbox Evasion - T1055 Process Injection - T1036.005 Match Legitimate Resource Name or Location - T1127.001 MSBuild - T1218.010 Regsvr32 - T1548.002 Bypass User Account Control - T1082 System Information Discovery - T1071.004 DNS - T1573.002 Asymmetric Cryptography - T1090.002 External Proxy - T1102.002 Bidirectional Communication - T1105 Ingress Tool Transfer - T1583.001 Domains - T1584.006 Web Services ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **Alien Backdoor C2 Beacon to welcome.supp0v3.com — Command and Control** (`TL-2026-0347-SPL-003`) Detects network connections and proxy/DNS traffic to the supp0v3.com C2 infrastructure and known backend IPs (147.45.178.61 AS215540, 104.21.63.112/172.67.145.101 Cloudflare, 95.216.51.236 Hetzner STX RAT) used by the CPUID supply chain backdoor. Catches both the HTTPS beacon to /d/callback and the DoH resolver pivot to 1.1.1.1 with the supp0v3.com query name. - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1071.001, T1071.004, T1090, T1568.002 - **Data sources:** proxy, zeek, firewall, microsoft_defender_for_endpoint, dns - **Severity:** critical - **Confidence:** high ### Splunk SPL ```spl (index=proxy OR index=zeek OR index=firewall OR sourcetype="stream:http" OR sourcetype="bro:http:json") (dest="welcome.supp0v3.com" OR dest="*.supp0v3.com" OR url="*supp0v3.com*" OR http_host="*supp0v3.com*" OR dest_ip IN (147.45.178.61, 104.21.63.112, 172.67.145.101, 95.216.51.236)) | eval c2_family=case(like(dest,"%supp0v3.com") OR like(url,"%supp0v3.com%"),"supp0v3_alien", dest_ip="147.45.178.61","supp0v3_backend_ai", dest_ip="95.216.51.236","stx_rat_hetzner", 1=1,"supp0v3_cloudflare") | stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources values(user) as users values(url) as urls values(http_host) as hosts by c2_family, dest_ip | table c2_family dest_ip sources users urls hosts count first_seen last_seen ``` ### Microsoft KQL ```kql DeviceNetworkEvents | where Timestamp > ago(7d) | where RemoteUrl has "supp0v3.com" or RemoteIP in ("147.45.178.61","104.21.63.112","172.67.145.101","95.216.51.236") | extend c2_family = case(RemoteUrl has "supp0v3.com","supp0v3_alien", RemoteIP=="147.45.178.61","supp0v3_backend_ai", RemoteIP=="95.216.51.236","stx_rat_hetzner","supp0v3_cloudflare") | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, c2_family ``` ### Sigma ```yaml title: Network Beacon To supp0v3.com C2 Infrastructure (CPUID Supply Chain) id: 9a8f2c4d-7e31-4c8a-bb21-cpuid347c2x1 status: experimental description: Detects Alien backdoor C2 traffic to welcome.supp0v3.com / *.supp0v3.com and the associated backend infrastructure used in the April 2026 CPUID supply chain compromise (TL-2026-0347). references: - https://intel.threadlinqs.com/threats/TL-2026-0347 author: Threadlinqs Team date: 2026/04/10 tags: - attack.command_and_control - attack.t1071.001 - attack.t1071.004 - attack.t1090 logsource: category: proxy detection: selection_domain: c-uri|contains: 'supp0v3.com' selection_host: cs-host|contains: 'supp0v3.com' selection_ip: dst_ip: - '147.45.178.61' - '95.216.51.236' condition: 1 of selection_* falsepositives: - None expected. supp0v3.com is operator-controlled infrastructure with no legitimate use. level: critical ``` **Known false positives:** - None expected — supp0v3.com is attacker-owned; any match should be treated as high-confidence. **Tuning notes:** Push domain and IP IOCs into your TI platform so proxy logs alert in real time. For Cloudflare fronting IPs (104.21.63.112, 172.67.145.101) require the hostname to match supp0v3.com — those IPs front legitimate Cloudflare traffic. Pair with JA3/JA4 fingerprint of the Alien beacon and the embedded JSON callback body tag 'tbs' for higher fidelity. ### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds - MDE — CPUID Utility Loading Unsigned [indicator] From Working Directory (locked: unlock with TL Creds) - MDE — Scheduled Task With 68-Minute Repeat + HKCU Run Registry Persistence (locked: unlock with TL Creds) - MDE — [indicator] C2 Beacon and DoH Resolver Pivot (locked: unlock with TL Creds) - Sigma — [indicator] Loaded From Non-System Directory (locked: unlock with TL Creds) - Sigma — Scheduled Task With 68-Minute Repeat And 20-Year Duration (locked: unlock with TL Creds) - Sigma — DNS-over-HTTPS Request To Cloudflare From Non-Browser Process (locked: unlock with TL Creds) - [indicator] Sideloaded by CPUID Utilities — Exploitation Phase (locked: unlock with TL Creds) - MSBuild Loader Executing .proj From User AppData — Post-Exploitation Persistence (locked: unlock with TL Creds) Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup ## Sample indicators (3 of 58) Defanged, TLP:CLEAR. - IP address: `147.45.178[.]61` - Domain: `supp0v3[.]com` - File hash: `eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46` Full set of 58 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds ## Sources - [Supply chain attack at CPUID pushes malware with CPU-Z/HWMonitor](https://www.bleepingcomputer.com/news/security/supply-chain-attack-at-cpuid-pushes-malware-with-cpu-z-hwmonitor/) - [CPU-Z 2.19 Supply Chain Attack Analysis — Trojanized DLL Sideloading with Zig-compiled CRYPTBASE.dll](https://gist.github.com/N3mes1s/b5b0b96782b9f832819d2db7c6684f84) - [CPUID compromised, HWMonitor and CPU-Z delivered malware](https://cybernews.com/security/cpuid-hwmonitor-hwinfo-cpuz-deliver-malware/) - [Warning: CPUID Suspected of Being a Virus; Suspicious HWMonitor Downloads Raise Alarms](https://www.igorslab.de/en/warning-cpuid-suspected-of-being-a-virus-suspicious-hwmonitor-downloads-are-causing-alarm/) - [CPUID Website Compromised to Deliver Weaponized HWMonitor and CPU-Z Tools](https://www.cryptika.com/cpuid-website-compromised-to-deliver-weaponized-hwmonitor-and-cpu-z-tools/) - [The official download for CPU-Z and HWMonitor has been hacked](https://www.pcgamer.com/software/security/cpuids-download-page-has-been-hacked-with-its-popular-processor-and-pc-info-tools-replaced-with-links-to-files-containing-malware/) - [HWMonitor and CPU-Z downloads hijacked to deliver malware to users](https://cyberinsider.com/hwmonitor-and-cpu-z-downloads-hijacked-to-deliver-malware-to-users/) - [Breach has been fixed, says CPUID, after CPU-Z and HWMonitor flagged as malware](https://www.pcguide.com/news/breach-has-been-fixed-says-cpuid-after-cpu-z-or-hwmonitor-flagged-as-malware-in-apparent-hack/) - [VideoCardz: CPU-Z and HWMonitor installers on CPUID site flagged for malware](https://videocardz.com/newz/popular-cpu-z-and-hwmonitor-software-installers-on-cpuid-site-flagged-for-malware) - [VirusTotal — eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46](https://www.virustotal.com/gui/file/eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46) - [CVE-2023-36025 Windows SmartScreen Security Feature Bypass](https://nvd.nist.gov/vuln/detail/CVE-2023-36025) ## Full data The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-0347