Skip to content

Instantly share code, notes, and snippets.

View 3ldidi94's full-sized avatar

3ldidi94

View GitHub Profile
@N3mes1s
N3mes1s / ANALYSIS.md
Last active April 21, 2026 08:36
CPU-Z 2.19 Supply Chain Attack Analysis (April 2026) - Trojanized DLL Sideloading with Zig-compiled CRYPTBASE.dll, IPv6-encoded .NET deserialization, MSBuild persistence

CPU-Z 2.19 Supply Chain Attack - Malware Analysis Report

Date: 2026-04-10 Analyst: nemesis Classification: Trojan / Backdoor (Alien RAT variant) Severity: CRITICAL Campaign ID: CityOfSin (extracted from C2 callback UTM parameters) Scope: CPUID official domain compromise affecting CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor 2, powerMAX + separately FileZilla Status: Breach confirmed and fixed by CPUID; site was compromised ~6 hours on April 9-10, 2026 CPUID Statement: "A secondary feature (a side API) was compromised for approximately six hours [...] causing the main website to randomly display malicious links. Our signed original files were not compromised."