Daemon Tools Hit by Month-Long Supply Chain Attack: Researchers Warn of Signed Malware
Breaking: Daemon Tools Installers Compromised
Security firm Kaspersky has revealed that the popular disk mounting app Daemon Tools was backdoored in a supply-chain attack that ran for over a month. The attack, which began on April 8, pushed malicious updates through the developer's own servers, signed with official digital certificates.
"This is a sophisticated attack that exploited trust in software updates," said a Kaspersky researcher. "Users who downloaded installers from the official Daemon Tools website during this period may have been infected."
Scope and Impact
Affected versions include 12.5.0.2421 through 12.5.0.2434 for Windows. The initial payload collects MAC addresses, hostnames, DNS domains, running processes, installed software, and system locales. This data is sent to an attacker-controlled server.
Kaspersky detected infections on thousands of machines across more than 100 countries. However, only about 12 machines—belonging to retail, scientific, government, and manufacturing organizations—received a follow-on payload, indicating targeted espionage.
Background
Daemon Tools is a widely used utility for mounting virtual disk images. Supply-chain attacks like this are particularly dangerous because the malware is signed with legitimate certificates, making it harder to detect. The attack remained active as of the time of Kaspersky's report, though the company did not specify when it ended.
What This Means
Users of Daemon Tools for Windows should immediately check their version number and update to the latest patched version. The incident underscores the growing threat of supply-chain compromises targeting widely used software. Organizations should monitor for unusual network traffic from Daemon Tools processes.
Kaspersky advises that infected machines may exhibit signs of data exfiltration. The company recommends full system scans and review of running processes for suspicious activity.
Related Articles
- Ubuntu 26.10 'Stonking Stingray' Set for October 15 Release: Canonical Unveils Development Timeline
- Why Choosing a Smart Home Platform Beats Buying a Hub First
- Grafana 13: Accelerating Insights and Scaling Operations with Ease
- macOS 27: Everything You Need to Know About the Next Major Mac Update
- Breathe New Life into Your Old Android Device: 25 Practical Ideas (Including a Free Wi-Fi Extender)
- How to Leverage Go 1.24 and 1.25 Features for Robust Production Systems
- How to Break Free from Twitter and Protect Your Sanity
- 10 Key Changes in Ubuntu 26.04 LTS 'Resolute Raccoon' Since 24.04