DAEMON Tools Lite Backdoored for 27 Days: Supply Chain Attack Targeted Government and Scientific Organizations in Russia, Belarus, and Thailand
Kaspersky found official DAEMON Tools Lite installers trojanized from April 8 to May 5, 2026, deploying a multi-stage backdoor to over a dozen targeted machines. CISA added CVE-2026-8398 to its KEV catalog on May 27.
Overview
The official installation packages for DAEMON Tools Lite, a widely used Windows disk-imaging and virtual drive utility developed by AVB Disc Soft, were silently trojanized for 27 days before discovery, distributing a multi-stage backdoor to systems across more than 100 countries. Kaspersky researchers published their findings on May 6, 2026, revealing that versions 12.5.0.2421 through 12.5.0.2434 were compromised, with the first malicious build appearing on April 8, 2026. The United States Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on May 27, 2026 as CVE-2026-8398, giving federal agencies until May 30, 2026 to remediate.
What We Know
Attack Scope and Scale
According to Kaspersky’s SecureList analysis, several thousand installation attempts involving the compromised binaries were detected across “around a hundred different countries and territories,” with the highest concentrations in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China. Roughly 10 percent of affected systems belonged to organizational environments, according to SecurityWeek.
Despite the broad geographic reach of the initial malware, the attackers exercised selective targeting for higher-capability payloads. Advanced second-stage backdoors were deployed to only a dozen machines belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand, as documented by Kaspersky. A single educational institution in Russia received the most sophisticated implant, the QUIC RAT, according to GBHackers.
How the Attack Was Executed
The attackers gained unauthorized access to AVB Disc Soft’s build or distribution infrastructure and modified three legitimate binaries that are part of the standard DAEMON Tools Lite installation: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe, according to BleepingComputer. The modified files were signed with the genuine AVB Disc Soft code-signing certificate, allowing them to pass signature-based security checks.
Kaspersky’s researchers note that “Whenever one of these binaries is launched…a backdoor gets activated. This backdoor is implanted in the startup code responsible for initializing the CRT environment.” The attackers had also registered the command-and-control domain env-check.daemontools[.]cc on March 27, 2026 — twelve days before the first malicious build was served — indicating deliberate pre-attack infrastructure preparation.
Malware Architecture
The attack deployed three payload stages, escalating in capability:
First stage — Information collector (envchk.exe): A .NET-based executable that beacons to the C2 server and exfiltrates MAC address, hostname, DNS domain name, running processes, installed software, and system locale, as described by Kaspersky. The researchers noted that “its code includes strings in Chinese.”
Second stage — Minimalistic backdoor (cdg.exe): Deployed manually to a small number of high-interest machines, this component decrypts RC4-encrypted payloads from the C2 and executes shell commands, downloads files, and runs shellcode in memory, according to GBHackers. Operational security missteps were visible in the deployment scripts — researchers found “manual misspellings found in the deployment scripts (such as typing ‘chiper’ instead of ‘cipher’),” suggesting hands-on, manual operator activity.
Third stage — QUIC RAT: A complex remote-access trojan written in C++, using control flow flattening obfuscation and statically linked with the WolfSSL library, as documented by Kaspersky SecureList. It supports HTTP, UDP, TCP, WSS, QUIC, DNS, and HTTP/3 protocols for command-and-control communication, and injects payloads directly into notepad.exe and conhost.exe processes on the victim machine.
Vulnerability Classification
The NVD entry for CVE-2026-8398 classifies the weakness under CWE-506 (Embedded Malicious Code), reflecting that the threat was not a coding bug in the software but malicious code delivered through the vendor’s own authenticated distribution channel. The vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL and a CVSS 4.0 score of 9.3 CRITICAL.
Vendor Response
Disc Soft stated it received notification of the compromise at approximately 07:00 GMT on May 5, 2026, according to the official company blog. The company acknowledged “unauthorized interference within our infrastructure,” explaining that “certain installation packages were impacted within our build environment and were released in a compromised state.” Within 12 hours, the company isolated and secured affected systems, removed compromised files from distribution, audited the build and release pipeline, and released clean version 12.6.0.2445. The company confirmed that DAEMON Tools Ultra, Pro, and other Disc Soft products were not affected and that the incident was limited to the free Lite version.
What We Don’t Know
Attribution remains unresolved. Kaspersky stated that “we do not currently attribute the DAEMON Tools compromise to any particular actor,” despite the presence of Chinese-language strings in the information collector’s code. The exact method by which attackers breached AVB Disc Soft’s build infrastructure has not been publicly disclosed. Disc Soft’s statement said the company “continues to investigate the root cause and full scope of the breach” and was not attributing the incident to any specific third party at the time of publication.
The full count of high-value machines that may have received second- or third-stage payloads beyond those Kaspersky observed in its telemetry is also unknown, since the company’s visibility is limited to systems running Kaspersky security products.
Analysis
The DAEMON Tools incident shares structural characteristics with a series of supply chain intrusions that have targeted software distribution infrastructure in 2026 — including the Mini Shai-Hulud worm that hit TanStack and over 160 npm and PyPI packages — but differs in a key respect: it targeted end-user desktop software rather than developer dependencies. DAEMON Tools Lite is a utility used by home users and corporate IT staff alike, providing the attacker with a much broader and less technically scrutinized infection surface than package registries.
The three-tier payload architecture is consistent with an intelligence-gathering operation rather than financially motivated extortion. The broad first-stage deployment served as automated triage — harvesting system profiles from thousands of machines to identify high-value targets — while the manually deployed second and third stages indicate that human operators reviewed the collected intelligence before selecting which dozen machines warranted full remote-access capability. The QUIC RAT’s multi-protocol design, designed to blend with legitimate encrypted traffic, further points toward persistent espionage rather than ransomware deployment.
For system administrators: DAEMON Tools Lite versions 12.5.0.2421 through 12.5.0.2434, installed between April 8 and May 5, 2026, should be uninstalled and replaced with version 12.6.0.2445 or later. Any system that installed an affected version should be scanned for the presence of envchk.exe, cdg.exe, or network connections to env-check.daemontools[.]cc or the IP address 38.180.107[.]76.