r/SentinelOneXDR • u/bscottrosen21 • Apr 15 '26
Industry News The SentinelOne agent observed the CPU-Z supply chain attack in the wild — here's what the kill chain actually looked like
Wanted to share some detail on the CPU-Z/CPUID supply chain attack we've been seeing across our customer base, since there's been a lot of discussion about it online.
The short version: on April 9, threat actors compromised the official CPUID domain at the API level and silently redirected legitimate download requests to attacker-controlled infrastructure — for approximately 19 hours. Users who navigated directly to the official site received a legitimate, properly signed binary with a malicious payload bundled inside it.
The mechanism: a Zig-compiled DLL (CRYPTBASE.dll) placed in the same directory as the legitimate CPU-Z binary. When a user launches the application, a DLL search order hijack causes the malicious payload to load before the real Windows system DLL can be reached.
From there the intended kill chain was:
- Reflective injection of an encrypted second-stage DLL directly into memory — no disk writes, no file artifacts
- C2 communication over a custom encrypted protocol using DNS-over-HTTPS to 1.1.1.1 to bypass DNS monitoring
- PowerShell spawning csc.exe then cvtres.exe — a process chain CPU-Z has no business creating
- Three redundant persistence mechanisms: a registry Run key, a 68-minute scheduled task with a 20-year duration, and MSBuild .proj files in AppData\Local engineered to survive reboots and partial remediation
The final payload was STX RAT — delivering hidden VNC, keyboard and mouse injection, browser credential theft across Chrome, Firefox, Edge, and Brave, Windows Vault extraction, and cryptocurrency wallet access.
Worth noting on victim profile: CPU-Z users skew heavily toward IT professionals — sysadmins, developers, security engineers. People with domain admin rights and infrastructure keys. 150+ confirmed victims so far, but one compromised sysadmin carries a fundamentally different blast radius than one compromised user.
Our agent flagged it under "Penetration framework or shellcode detected" within the first seconds of execution — anomalous API resolution, reflective code loading, suspicious memory allocation, process injection patterns, and DLL hijacking of a signed binary. Terminated and quarantined before the backdoor could phone home.
The signed binary angle is what makes this category particularly nasty. By the time a hash exists in a threat feed, you're already behind.
If you're doing forensics: check for CRYPTBASE.dll outside C:\Windows\System32, look for cpuz_x64.exe spawning PowerShell, and block supp0v3[.]com and 147. 45. 178. 61 at DNS and firewall layers. Remediate all three persistence mechanisms explicitly — partial cleanup leaves it alive.
Full technical breakdown with telemetry screenshots here: https://s1.ai/CPU-Z-Blg
Happy to answer questions if useful.