DAEMON Tools Supply Chain Attack Distributes Backdoors via Trojanized Installers In May 2026, Kaspersky researchers uncovered a sophisticated supply chain attack targeting users of DAEMON Tools, a widely used disk image mounting software. The compromised installers versions 12.5.0.2421 through 12.5.0.2434 were distributed directly from the official website beginning April 8, 2026, and remained available for nearly a month. The attackers embedded malicious payloads in three core binaries within the installation directory (DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe). Upon execution at system startup, the malware triggered a backdoor that communicated with a typosquatted command-and-control (C2) domain env-check.daemontools[.]cc registered on March 27, 2026, just days before the attack commenced. The campaign affected thousands of systems across over 100 countries, with the majority of victims located in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China. While 90% of infections targeted individual users, a smaller subset of retail, scientific, government, and manufacturing organizations primarily in Russia, Belarus, and Thailand received advanced payloads, suggesting a targeted espionage or "big game hunting" motive. The attack employed a three-stage payload chain: 1. Information Collector (*envchk.exe*) – A .NET-based tool that harvested system details (MAC address, hostname, installed software, processes) and exfiltrated data to 38.180.107[.]76. The presence of Chinese-language strings in its code pointed to a likely Chinese-speaking threat actor. 2. Minimalistic Backdoor (*cdg.exe*) – An RC4-encrypted shellcode loader deployed to roughly a dozen high-value machines, enabling file downloads, command execution, and in-memory shellcode deployment. 3. QUIC RAT – A sophisticated C++ implant, observed in a single attack against a Russian educational institution, featuring multi-protocol C2 communication (HTTP, UDP, TCP, WSS, QUIC, DNS, HTTP/3) and process injection capabilities. The trojanized installers were signed with legitimate digital certificates from AVB Disc Soft, the software’s developer, allowing them to bypass security tools. Key indicators of compromise (IOCs) include the malicious C2 domain, the IP address 38.180.107[.]76, and specific file hashes for the infected installers and payloads. Suspicious file paths, such as C:\Windows\Temp\envchk.exe and %AppData%\Microsoft\mcrypto.dat, were also identified.

Federal prosecutors in the U.S. accused a trio—including Ryan Clifford Goldberg, Kevin Tyler Martin, and an unnamed co-conspirator—of deploying BlackCat (ALPHV) ransomware against this Tampa-based medical device firm in May 2023. The attackers infiltrated the company’s network, exfiltrated sensitive data, and encrypted systems, demanding a $10 million ransom. While negotiations reduced the payment, the company ultimately transferred $1.274 million in cryptocurrency to regain access to its systems and prevent further data leaks. The attack disrupted operations, risked exposure of proprietary medical device designs, and compromised internal employee and customer data—including potentially health records, financial details, and intellectual property. The incident forced the company to engage in costly incident response, legal consultations, and system recovery efforts. The FBI’s investigation later revealed that one of the perpetrators (Goldberg) was a cybersecurity incident response manager at Sygnia, exploiting insider knowledge to facilitate the attack. The breach not only caused financial losses but also reputational damage, as the company’s failure to prevent the attack eroded trust among partners and clients. The case remains under legal scrutiny, with two defendants facing up to 50 years in prison if convicted.