DAEMON Tools Supply Chain Attack Analysis: Malicious Installer Backdoor and RAT

Summary of DAEMON Tools Supply Chain Attack Incident Vulnerability Overview Attack Type: Supply Chain Attack. Affected Software: DAEMON Tools (a tool for mounting disk images). Attack Start Date: April 8, 2026. Modus Operandi: The attackers tampered with DAEMON Tools installers (versions 12.5.0.2421 to 12.5.0.2434) to implant a malicious payload. These installers possess valid digital signatures. Malicious Behaviors: 1. Upon installation, the installer activates a backdoor and sends a GET request to a malicious server. 2. The server returns commands to download and execute an Information Collector. 3. For specific targets (such as government agencies and research institutions), more complex "Minimalistic backdoors" and QUIC RATs are deployed. Scope of Impact Number of Infections: Thousands of infection attempts, involving individuals and organizations in over 100 countries worldwide. Target Industries: Retail, Science, Government, Manufacturing. Geographic Distribution: Primarily located in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China. Affected Files: Remediation Vendor Response: The vendor has confirmed the issue and released a new version, 12.6.0.2445, which removes the malicious behavior. User Recommendations: Check if the system has installed affected versions (12.5.0.2421 - 12.5.0.2434). Upgrade to the latest version. * Use Kaspersky security software for detection and protection. Technical Details and Code Extraction 1. Malicious Communication URL Construction Code The attackers modified the startup code to send GET requests to the malicious server. 2. Information Collector Deployment Code The attackers download and execute the Information Collector via PowerShell commands. 3. Information Collector Code Snippet (with Hardcoded Chinese Strings) The Information Collector gathers MAC addresses, hostnames, DNS domain names, process lists, installed software lists, and system locale settings. 4. Minimalistic Backdoor Deployment Code A backdoor deployed for specific targets to download and . 5. Minimalistic Backdoor Execution Command Code Code used for command execution by the backdoor. 6. Backdoor Non-Execution Case Due to Typos In some instances, the attackers used incorrect spellings, causing the backdoor deployment to fail.

Goal Reached Thanks to every supporter — we hit 100%!

DAEMON Tools Supply Chain Attack Analysis: Malicious Installer Backdoor and RAT