Reported by 1 outlet
DAEMON Tools trojanized in active supply-chain attack — digitally signed installers deliver backdoor to thousands across 100+ countries
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
DAEMON Tools trojanized in active supply-chain attack — digitally signed installers deliver backdoor to thousands across 100+ countries
bleepingcomputer.com · 161d ago · May 6th, 2026
A sophisticated supply-chain attack has compromised DAEMON Tools installers (versions 12.5.0.2421 through 12.5.0.2434), specifically the DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe binaries. Since April 8, thousands of systems across more than 100 countries downloaded the trojanized software from the official DAEMON Tools website. The attack evaded detection for nearly a month. Kaspersky reports that while first-stage infections are widespread, second-stage payloads were deployed to only about a dozen machines — indicating a highly targeted operation focused on high-value victims in retail, scientific, government, and manufacturing sectors in Russia, Belarus, and Thailand. String analysis suggests a Chinese-speaking threat actor. The first-stage payload acts as an information stealer (hostname, MAC, processes, locale) for victim profiling, while qualifying targets receive a lightweight backdoor capable of in-memory code execution. In at least one case, the advanced QUIC RAT multi-protocol implant was deployed against a Russian educational institution. Organizations should audit any machines with DAEMON Tools installed on or after April 8 for abnormal activity, and verify software integrity against known-good hashes.