CPUID Supply Chain Attack Delivers STX RAT via Trojanized CPU-Z, HWMonitor, and PerfMonitor Downloads — Threadlinqs Intelligence
As of 2026-05-30, CPUID Supply Chain Attack Delivers STX RAT via Trojanized CPU-Z, HWMonitor, and PerfMonitor Downloads is a critical-severity supply chain threat attributed to CityOfSin (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-0364 · Severity: CRITICAL · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: CityOfSin · Russia · FINANCIAL
On April 9, 2026, threat actors compromised cpuid.com at the API level, silently redirecting official CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor downloads to trojanized binaries bundling STX
A Russian-nexus threat actor compromised the CPUID website (cpuid.com) between April 9, 2026 at 15:00 UTC and April 10, 2026 at 10:00 UTC, exploiting a secondary backend API to replace legitimate download links with URLs pointing to trojanized installers hosted on attacker-controlled Cloudflare R2 infrastructure and compromised websites. The attack affected CPU-Z v2.19, HWMonitor v1.63, HWMonitor Pro v1.57, PerfMonitor v2.04, and powerMAX v1.00.
The trojanized packages bundled legitimate, CPUID-signed executables alongside a malicious CRYPTBASE.dll compiled in the Zig programming language. The attack leverages transitive DLL sideloading: when cpuz_x64.exe loads ADVAPI32.dll, Windows attempts to resolve CRYPTBASE.dll, loading the attacker's version from the application directory instead of System32.
Upon execution, CRYPTBASE.dll's DllMain suspends the legitimate application's main thread and spawns worker threads for payload execution. A 349KB colon-hex encoded shellcode payload in the .rdata section is decoded, then a reflective PE loader (out.dll) is loaded using position-independent shellcode. The loader performs DNS-over-HTTPS resolution via Cloudflare's 1.1.1.1 resolver for welcome.supp0v3.com, then establishes an HTTPS C2 callback to https://welcome.supp0v3.com/d/callback with embedded campaign tracking (utm_source=CityOfSin). The C2 backend runs Caddy server behind Cloudflare CDN fronting.
The C2 response triggers a multi-stage payload chain: PowerShell is spawned with stdin-piped execution ([Console]::In.ReadToEnd() | Invoke-Expression) to evade command-line logging. This compiles a .NET DLL in-memory via csc.exe/cvtres.exe, which deploys four independent persistence mechanisms simultaneously:
1. Registry Run Keys: Random GUID-named entries under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run launching MSBuild.exe with malicious .proj files containing inline C# tasks that decrypt XOR-encrypted shellcode from BuildCache.dat.
2. Scheduled Task: A task executing every 68 minutes with a 20-year duration at highest privilege, triggering MSBuild.exe with CommonBuild.proj.
3. COM TypeLib Hijacking: Hijacks the IScriptControl TypeLib GUID {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}, triggering when any application loads IScriptControl. The chain flows through ActiveX.sct to regsvr32.exe to Clippy.sct, which uses BinaryFormatter deserialization of an IPv6-encoded .NET assembly (Moniker.dll).
4. PowerShell Profile Autorun: Installs autorun.ps1 in the user's PowerShell directory with a hidden, bypass-execution-policy Run key.
STX RAT's capabilities include hidden VNC (invisible desktop sessions), keyboard/mouse injection, browser credential theft (Chrome, Firefox, Edge, Brave), Windows Vault extraction, cryptocurrency wallet access, in-memory execution of additional payloads (EXE/DLL/PowerShell/shellcode), reverse proxy and tunneling, and custom encrypted C2 communication via DNS-over-HTTPS.
The threat actor (handle @d_coroner, campaign ID CityOfSin) has been operational since at least September 2025, conducting .url exploit campaigns targeting LibreOffice and Google Drive via CVE-2023-36025 SmartScreen bypass from the same 147.45.178.61 backend. The supp0v3.com domain was registered October 29, 2025, with the production C2 subdomain activated December 11, 2025. The same infrastructure was reused for a FileZilla supply chain campaign in March 2026, demonstrating poor operational security that enabled rapid attribution. The 147.45.178.61 backend (AS215540, Global Connectivity Solutions LLP, Frankfurt) presents a stolen VK.com wildcard TLS certificate and runs OpenSSH 9.6p1 Ubuntu with Apache httpd.
Kaspersky confirmed 150+ victims from their telemetry, primarily in Brazil, Russia, and China, with affected organizations spanning retail, manufacturing, consulting, telecommunications, and agriculture sectors. The victim profile skews toward IT professionals (system administrators, developers, security engineers) who routinely
Weaknesses (CWE)
CWE-426, CWE-494, CWE-502
Target sectors: retail, manufacturing, consulting, telecommunications, agriculture
Target regions: South America, Eastern Europe, Asia, Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1059, T1059, T1127, T1547, T1053, T1546, T1546, T1574, T1620