Kaspersky said on May 5, 2026, that attackers had compromised DAEMON Tools installers distributed through the disk-image mounting software’s official website, delivering malware in a supply-chain attack dating to April 8.
In a subsequent statement dated May 6, developer Disc Soft Limited acknowledged that compromised installation packages had been released from its build environment. The company said the incident affected the free DAEMON Tools Lite version 12.5.1 and that paid Lite editions, DAEMON Tools Pro and DAEMON Tools Ultra were unaffected.
Kaspersky’s initial findings identified compromised builds ranging from 12.5.0.2421 through 12.5.0.2434. The cybersecurity company said the altered executables carried valid digital signatures belonging to the developer, AVB Disc Soft.
Thousands of attempted payload deployments
Kaspersky recorded thousands of attempted malicious payload deployments across more than 100 countries and territories. Most affected systems were in Russia, Brazil, Turkey, Spain, Germany, France, Italy and China, the company said.
About 10% of the affected systems belonged to businesses or organizations, according to Kaspersky’s analysis. Those observations came from its own telemetry and did not represent a complete global count.
The researchers observed follow-on backdoors on about a dozen machines belonging to government, scientific, manufacturing and retail organizations in Russia, Belarus and Thailand. Kaspersky assessed that this limited deployment indicated selective targeting, although the attackers’ objective remained unclear.
Compromised files and follow-on malware
Kaspersky identified three altered executables in the DAEMON Tools installation directory: DTHelper.exe, DiscSoftBusServiceLite.exe and DTShellHlp.exe. Its technical findings described Windows executables and processes.
When the compromised binaries launched at system startup, they activated a backdoor that contacted an attacker-controlled server, the researchers said. That server could return shell commands instructing the computer to download and execute additional malicious files.
The first downloaded payload Kaspersky identified was an information collector. It gathered a MAC address, hostname, DNS domain name, lists of running processes and installed software, and system locale information, then transmitted those details to the attackers’ infrastructure.
Kaspersky assessed that the collector profiled infected computers so the attackers could select systems for additional payloads. One follow-on tool was a lightweight backdoor capable of downloading files, executing shell commands and running shellcode in memory.
The researchers also reported a more complex backdoor, which they named QUIC RAT, on one machine at an educational institution in Russia. Their initial analysis found that it supported several communication protocols and could inject payloads into the legitimate Windows processes notepad.exe and conhost.exe. Analysis of that implant was still ongoing.
Subsequent statements dated May 6
Kaspersky said it identified the compromised installers in early May, approximately a month after the earliest malicious release it traced to April 8. It described the attack as ongoing in its initial May 5 disclosure.
Disc Soft’s subsequent May 6 statement said it had received notification at approximately 07:00 GMT on May 5 and implemented its response measures within less than 12 hours. The company said those measures included securing affected systems, removing compromised files from distribution, auditing its build and release pipeline, and rebuilding installation packages.
The developer said DAEMON Tools Lite version 12.6 was released on May 5 without the suspected compromised files. In an update dated May 6, Kaspersky said release 12.6.0.2445 no longer exhibited the malicious behavior described in its analysis.
Disc Soft said its assessment was that the distribution issue had been contained, while its investigation into the root cause and full scope continued. Neither Disc Soft nor Kaspersky attributed the incident to a specific threat actor.
