CPUID Supply Chain Attack Delivers STX RAT via Trojanized CPU-Z, HWMonitor, and PerfMonitor Downloads
CPUID Supply Chain Attack Delivers STX RAT via Trojanized (TL-2026-0364), also tracked as CPUID Watering Hole Attack, is a critical-severity supply-chain compromise, first published 2026-04-14. It is attributed to CityOfSin (Russia) with medium confidence, affects CPUID CPU-Z, maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1053), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-0364
- Threat ID
- TL-2026-0364
- Also known as
- CPUID Watering Hole Attack, CPU-Z Supply Chain Compromise, Operation CityOfSin
- Severity
- CRITICAL
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-04-14
- Last reviewed
- 2026-04-14
- Attribution
- CityOfSin
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- retail, manufacturing, consulting, telecommunications, agriculture
- Target regions
- South America, Eastern Europe, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in CPUID Supply Chain Attack Delivers STX RAT via Trojanized
Malware and tooling: Backdoor.Win64.Alien, STX RAT, STX RAT C2 via Caddy + Cloudflare CDN fronting
On April 9, 2026, threat actors compromised cpuid.com at the API level, silently redirecting official CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor downloads to trojanized binaries bundling STX RAT. The memory-only RAT uses DLL search order hijacking via CRYPTBASE.dll, establishes quad-persistence (registry run keys, scheduled tasks, COM TypeLib hijacking, PowerShell profile), and exfiltrates credentials via DNS-over-HTTPS through Cloudflare. Over 150 confirmed victims across retail, manufacturing, telecom, consulting, and agriculture sectors during a 19-hour operational window. Infrastructure linked to prior March 2026 FileZilla campaign and September 2025 .url exploit operations via shared C2 domain supp0v3.com and backend server 147.45.178.61.
How CPUID Supply Chain Attack Delivers STX RAT via Trojanized works
A Russian-nexus threat actor compromised the CPUID website (cpuid.com) between April 9, 2026 at 15:00 UTC and April 10, 2026 at 10:00 UTC, exploiting a secondary backend API to replace legitimate download links with URLs pointing to trojanized installers hosted on attacker-controlled Cloudflare R2 infrastructure and compromised websites. The attack affected CPU-Z v2.19, HWMonitor v1.63, HWMonitor Pro v1.57, PerfMonitor v2.04, and powerMAX v1.00.
The trojanized packages bundled legitimate, CPUID-signed executables alongside a malicious CRYPTBASE.dll compiled in the Zig programming language. The attack leverages transitive DLL sideloading: when cpuz_x64.exe loads ADVAPI32.dll, Windows attempts to resolve CRYPTBASE.dll, loading the attacker's version from the application directory instead of System32.
Upon execution, CRYPTBASE.dll's DllMain suspends the legitimate application's main thread and spawns worker threads for payload execution. A 349KB colon-hex encoded shellcode payload in the .rdata section is decoded, then a reflective PE loader (out.dll) is loaded using position-independent shellcode. The loader performs DNS-over-HTTPS resolution via Cloudflare's 1.1.1.1 resolver for welcome.supp0v3.com, then establishes an HTTPS C2 callback to https://welcome.supp0v3.com/d/callback with embedded campaign tracking (utm_source=CityOfSin). The C2 backend runs Caddy server behind Cloudflare CDN fronting.
The C2 response triggers a multi-stage payload chain: PowerShell is spawned with stdin-piped execution ([Console]::In.ReadToEnd() | Invoke-Expression) to evade command-line logging. This compiles a .NET DLL in-memory via csc.exe/cvtres.exe, which deploys four independent persistence mechanisms simultaneously:
1. Registry Run Keys: Random GUID-named entries under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run launching MSBuild.exe with malicious .proj files containing inline C# tasks that decrypt XOR-encrypted shellcode from BuildCache.dat.
2. Scheduled Task: A task executing every 68 minutes with a 20-year duration at highest privilege, triggering MSBuild.exe with CommonBuild.proj.
3. COM TypeLib Hijacking: Hijacks the IScriptControl TypeLib GUID {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}, triggering when any application loads IScriptControl. The chain flows through ActiveX.sct to regsvr32.exe to Clippy.sct, which uses BinaryFormatter deserialization of an IPv6-encoded .NET assembly (Moniker.dll).
4. PowerShell Profile Autorun: Installs autorun.ps1 in the user's PowerShell directory with a hidden, bypass-execution-policy Run key.
STX RAT's capabilities include hidden VNC (invisible desktop sessions), keyboard/mouse injection, browser credential theft (Chrome, Firefox, Edge, Brave), Windows Vault extraction, cryptocurrency wallet access, in-memory execution of additional payloads (EXE/DLL/PowerShell/shellcode), reverse proxy and tunneling, and custom encrypted C2 communication via DNS-over-HTTPS.
The threat actor (handle @d_coroner, campaign ID CityOfSin) has been operational since at least September 2025, conducting .url exploit campaigns targeting LibreOffice and Google Drive via CVE-2023-36025 SmartScreen bypass from the same 147.45.178.61 backend. The supp0v3.com domain was registered October 29, 2025, with the production C2 subdomain activated December 11, 2025. The same infrastructure was reused for a FileZilla supply chain campaign in March 2026, demonstrating poor operational security that enabled rapid attribution. The 147.45.178.61 backend (AS215540, Global Connectivity Solutions LLP, Frankfurt) presents a stolen VK.com wildcard TLS certificate and runs OpenSSH 9.6p1 Ubuntu with Apache httpd.
Kaspersky confirmed 150+ victims from their telemetry, primarily in Brazil, Russia, and China, with affected organizations spanning retail, manufacturing, consulting, telecommunications, and agriculture sectors. The victim profile skews toward IT professionals (system administrators, developers, security engineers) who routinely download hardware diagnostic tools, making this supply chain vector particularly effective for targeting privileged access holders. Post-infection access sales to ransomware affiliates typically activate within 60-90 days.
MITRE ATT&CK techniques used in TL-2026-0364
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Persistence
T1053 Scheduled Task/Job; T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Credential Access
T1056 Input Capture; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1127 Trusted Developer Utilities Proxy Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1573 Encrypted Channel
Initial Access
Affected products and versions in CPUID Supply Chain Attack Delivers STX RAT via Trojanized
- CPUID — CPU-Z
Vulnerable versions: 2.19
Fixed in: 2.19 (re-released post-incident) - CPUID — HWMonitor
Vulnerable versions: 1.63
Fixed in: 1.63 (re-released post-incident) - CPUID — HWMonitor Pro
Vulnerable versions: 1.57
Fixed in: 1.57 (re-released post-incident) - CPUID — PerfMonitor
Vulnerable versions: 2.04
Fixed in: 2.04 (re-released post-incident) - CPUID — powerMAX
Vulnerable versions: 1.00
Remediation for CPUID Supply Chain Attack Delivers STX RAT via Trojanized
Patches
- Re-download CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor from verified cpuid.com after April 10 2026
- Verify all CPUID software downloads against official hashes published post-incident
Immediate actions
- Block supp0v3.com and *.supp0v3.com at DNS and proxy layers
- Block 147.45.178.61 at perimeter firewall
- Block Cloudflare R2 distribution buckets: pub-45c2577dbd174292a02137c18e7b1b5a.r2.dev, pub-fd67c956bf8548b7b2cc23bb3774ff0c.r2.dev, pub-f3252d8370f34f0d9f3b3c427d3ac33c.r2.dev
- Block distribution domains: cahayailmukreatif.web.id, transitopalermo.com, vatrobran.hr
- Search fleet for CRYPTBASE.dll outside C:\Windows\System32
- Hunt for process chain: cpuz_x64.exe spawning powershell.exe spawning csc.exe
- Add all SHA256 hashes to EDR/AV block lists
- Quarantine any systems that downloaded CPUID software between April 9-10 2026
Workarounds
- Remove all four persistence mechanisms: registry Run keys with MSBuild/PowerShell, scheduled tasks, COM TypeLib GUID {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}, PowerShell profile autoruns
- Delete persistence files: c_3791.proj, CommonBuild.proj, BuildCache.dat, ActiveX.sct, Clippy.sct, Moniker.dll, data.dat, autorun.ps1 from AppData directories
- Use portable versions of hardware diagnostic tools from verified alternative sources until CPUID completes security review
Longer-term hardening
- Deploy behavioral EDR with reflective code loading detection
- Monitor DNS-over-HTTPS traffic for anomalous resolution patterns
- Implement application allowlisting to prevent DLL sideloading
- Monitor for MSBuild.exe executing .proj files from AppData directories
- Monitor registry Run keys for MSBuild/PowerShell persistence patterns
- Hunt for scheduled tasks with 68-minute intervals or 20-year durations
- Monitor COM TypeLib registry modifications for hijacking attempts
- Credential rotation for all affected users within 30 days
- Monitor for lateral movement and credential reuse for 60-90 days post-remediation
Weaknesses (CWE) in CPUID Supply Chain Attack Delivers STX RAT via Trojanized
CWE-426, CWE-494, CWE-502
Timeline of CPUID Supply Chain Attack Delivers STX RAT via Trojanized
- Threat actor begins .url exploit campaigns using 147.45.178.61 backend targeting LibreOffice via CVE-2023-36025 SmartScreen bypass
- C2 domain supp0v3.com registered; ai.supp0v3.com staging/development server goes live at 147.45.178.61
- helloworld.supp0v3.com testing subdomain activated for C2 infrastructure validation
- welcome.supp0v3.com production C2 subdomain activated behind Cloudflare CDN fronting with Caddy backend
- First CRYPTBASE.dll variant (v1, 2.2MB) compiled in Zig language appears in the wild
- FileZilla supply chain campaign launched using identical C2 infrastructure (supp0v3.com, 147.45.178.61) with version.dll sideloading
- CPU-Z v2.19 officially signed by CPUID with Sectigo EV certificate — legitimate binary later abused in trojanized packages
- powerMAX v1.00 trojanized package created and staged on Cloudflare R2 distribution infrastructure
- CPUID website API compromised at 15:00 UTC; legitimate download links redirected to trojanized installers on R2 buckets and compromised hosting
- Malicious download URLs removed from cpuid.com at approximately 10:00 UTC — 19-hour operational window closed
- Kaspersky Securelist, eSentire, and multiple security vendors publish detailed technical analyses with IOCs and YARA rules
- SentinelOne publishes comprehensive blog detailing autonomous EDR detection and full attack chain analysis
- As of 2026-05-29, the 19-hour CPUID download compromise is closed/remediated (trojanized CPU-Z/HWMonitor no longer served), but the CityOfSin/@d_coroner actor, STX RAT tooling, and reused supp0v3.com/147.45.178.61 C2 remain live. The same operator ran parallel FileZilla and financial-sector campaigns with no public takedown or arrest, and likely sells access to ransomware affiliates.
Sources cited for CPUID Supply Chain Attack Delivers STX RAT via Trojanized
- SentinelOne: Securing the Software Supply Chain - CPU-Z Watering Hole
- Kaspersky Securelist: CPU-Z & HWMonitor Watering Hole Attack
- The Hacker News: CPUID Breach Distributes STX RAT
- N3mes1s: CPU-Z 2.19 Supply Chain Attack Deep Analysis
- Help Net Security: Hackers Hijacked CPUID Downloads
- Cyderes: Monitoring the Monitor - CPUID HWMonitor Supply Chain Hijack
- Security Affairs: CPUID Watering Hole Attack Spreads STX RAT
- SecurityOnline: The CPUID Watering Hole Attack
- UV Cyber: Threat Advisory - CPUID Compromise
- CyberSecSentinel: CPUID Supply Chain Attack Delivers STX RAT
Threats related to CPUID Supply Chain Attack Delivers STX RAT via Trojanized
Detection coverage for TL-2026-0364
As of 2026-04-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0364 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.