DAEMON Tools Was Trojaned for a Month. The Installers Were Signed.

Green lines of code cascading down a dark computer screen in a matrix-style pattern — Photo via Unsplash

TL;DR: From April 8 to May 5, 2026, anyone who downloaded DAEMON Tools Lite from the official website got malware with their installer. Kaspersky found that versions 12.5.0.2421 through 12.5.0.2434 had been trojaned with a multi-stage backdoor. The binaries were digitally signed by the real developer, Disc Soft Ltd. Thousands of machines were infected across 100+ countries, with about 10% belonging to organizations. The attackers (linked to a Chinese-speaking threat group) cherry-picked roughly 12 high-value targets from the infected pool for deeper compromise, including government, scientific, and manufacturing entities in Russia, Belarus, and Thailand. One target got a custom implant called QUIC RAT that speaks seven different protocols to its command servers. This is the fourth major software supply chain attack of 2026, following eScan in January, Notepad++ (disclosed February), and CPUID in April. A patched version (12.6.0.2445) is available now.

What Happened

On May 5, Kaspersky published research showing that DAEMON Tools Lite (the widely used disk imaging software) had been serving trojaned installers from its official website since April 8 ^[1][2]. Not a lookalike domain. Not a fake download mirror. The real website, run by the real company, handing out malware signed with the real company's digital certificates.

The attackers compromised three executables bundled with the installer: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. They injected malicious code directly into the CRT initialization routines, the code that runs before the application itself even starts. By the time DAEMON Tools loaded, the backdoor was already phoning home ^[2][3].

The command-and-control domain, env-check.daemontools[.]cc, was registered on March 27, twelve days before the first trojaned installer appeared. This was planned ^[2].

The Four-Stage Kill Chain

This was not a smash-and-grab. The attackers built a layered infection chain designed to stay quiet and get selective:

Stage 1. Initial implant: The compromised binaries phone home via HTTP GET, requesting shell commands that execute through cmd.exe. Basic, but enough to assess the machine ^[2]
Stage 2. Reconnaissance: A .NET executable called envchk.exe drops onto the machine, harvesting hostname, MAC address, language settings, running processes, and installed software. This is the sorting step: the attackers figure out what they have caught ^[1][3]
Stage 3. Lightweight backdoor: A shellcode loader (cdg.exe) decrypts a payload from cdg.tmp and launches a minimalist backdoor that can download files, execute shell commands, and inject code in-memory ^[2]
Stage 4. QUIC RAT: For the highest-value targets only. A custom C++ implant with support for seven communication protocols: HTTP, UDP, TCP, WebSocket Secure, QUIC, DNS, and HTTP/3. It injects itself into notepad.exe and conhost.exe, two processes nobody thinks to check ^[1][2]

That last stage only hit a single target: an educational institution in Russia ^[2]. The rest of the roughly 12 organizations that received Stage 3 payloads were in the retail, scientific, government, and manufacturing sectors across Russia, Belarus, and Thailand ^[1][3].

The wide net catches thousands. The real operation targets a dozen.

The Scale of the Dragnet

Kaspersky detected "several thousand" infection attempts across their telemetry alone, meaning the actual number is almost certainly higher ^[1]. The infections spanned 100+ countries, with concentrations in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China ^[2][3].

About 90% of infected machines belonged to home users. The other 10% (hundreds of organizational systems) were running in corporate or government environments ^[2]. Most of those organizations have no idea. Kaspersky found the attack. The targets mostly did not.

The only silver lining: the Pro and Ultra versions of DAEMON Tools were not affected. Only the free Lite version was trojaned ^[2]. Which means the people most at risk are the ones who were just trying to avoid paying for software. A bitter irony when the free version comes with a state-sponsored backdoor.

Who Did This

Kaspersky identified Chinese-language artifacts embedded in the malicious code, pointing to a Chinese-speaking threat actor. They stopped short of naming a specific group ^[1][2]. The targeting profile (government and scientific entities, a multi-protocol RAT with DNS and QUIC capabilities, careful victim selection from a wide infection pool) is consistent with Chinese cyberespionage operations, but the researchers left the door open on attribution.

The developer, Disc Soft Ltd (known as AVB Disc Soft), confirmed the compromise was "limited to the free DAEMON Tools Lite version" and said they released corrective measures within 12 hours of notification ^[2]. They pushed out a clean version, 12.6.0.2445, on May 5 ^[2].

BleepingComputer reported that Disc Soft had not responded to their contact request by publication time ^[3]. Twelve hours to patch. Radio silence to the press. That is a company in crisis mode.

2026: The Year of Supply Chain Attacks

DAEMON Tools is the fourth major software supply chain compromise in five months:

January 2026: eScan: The Indian antivirus company's update servers were hijacked to push multi-stage malware to users across South Asia. Hundreds of machines compromised. Your antivirus delivered the virus ^[4][5]
February 2026 (disclosed): Notepad++: A group called Lotus Blossom compromised Notepad++'s hosting infrastructure from June through December 2025, hijacking the update mechanism to selectively deliver trojaned executables to government and telecom targets in Southeast Asia ^[6][7]
April 2026: CPUID: The official website for HWMonitor, a popular hardware monitoring tool, was compromised. Users downloading version 1.63 received a malicious installer ^[8]
April–May 2026: DAEMON Tools: One month of signed, trojaned installers served from the official website to thousands of users worldwide

Four supply chain attacks. Four widely trusted software tools. Four legitimate distribution channels turned into malware delivery systems. The pattern is clear: attackers have stopped trying to trick you into downloading from shady sites. They compromised the sites you already trust.

Why This Matters Beyond the Malware

The core problem with supply chain attacks is that they break the one piece of security advice everyone follows: download from the official source.

Digital signatures are supposed to solve this. If the binary is signed by the real developer, it should be safe. DAEMON Tools' installers were signed by Disc Soft's legitimate certificates. Windows did not warn you. Your antivirus (if you were not running Kaspersky) probably did not either. The trust chain functioned exactly as designed. It just happened to be delivering malware.

Kaspersky researchers put it directly: "A compromise of this nature bypasses traditional perimeter defenses because users implicitly trust digitally signed software" ^[1].

That implicit trust is the vulnerability. Not a bug in the code. Not a misconfigured server. The assumption that signed software from official sources is safe. That is what got exploited four times in five months.

What to Do Right Now

If you installed DAEMON Tools Lite between April 8 and May 5, 2026:

Check your version. If you have 12.5.0.2421 through 12.5.0.2434, you are affected
Isolate the machine. Disconnect from your network until you have assessed the damage
Scan for the compromised files. Look for DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe in your DAEMON Tools installation directory
Check for indicators. Look for connections to daemontools[.]cc domains. Check for unexpected instances of envchk.exe, cdg.exe, or cdg.tmp
Update or uninstall. Version 12.6.0.2445 is clean. Or just uninstall it entirely. There are open-source disk imaging alternatives that do not come with Chinese backdoors
Run a full security sweep. If the attackers deployed Stage 3 or Stage 4 payloads, basic uninstallation is not enough. You need a full forensic assessment

If you are an organization and you see DAEMON Tools installed on corporate machines: treat it as a potential compromise. The 10% organizational infection rate means plenty of business systems were hit.

Sources

Published: May 7, 2026