INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Malware Was Discovered in Daemon Tools Software

| 2026-05-07 09:30 MEDIUM HIGH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
The supply chain attack on Daemon Tools software has been contained, but not before it infected thousands of machines across more than 100 countries. The incident began when threat actors exploited a vulnerability in the application's installer to hide malware, which was then distributed from the main website. As a result, victims were left vulnerable to various types of cyber attacks, including Trojanized versions of popular software and malicious payloads injected into system processes like [IOC HIDDEN • LOGIN REQUIRED] and [IOC HIDDEN • LOGIN REQUIRED]. The attack highlights the importance of vigilance when installing new software and the need for organizations to carefully examine machines that had Daemon Tools installed after April 8.
Technical Mitigations AI-generated
• Audited the build and release pipeline to identify and isolate affected systems • Rebuilt and validated installation packages to strengthen internal security controls • Strengthened internal security monitoring systems
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
no•••••.exe
co•••••.exe
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Campaign EarlierCampaign Earlier
Target & Sectors
DACH DACH manufacturingmanufacturing technologytechnology
Incident Timeline
‎April 8
China-Linked Backdoor Campaign warned users that Daemon Tools software installers distributed from the main website had been Trojanized.
source_region China
The developer urged any user who downloaded the affected version to: Uninstall the application Run a full system scan using trusted security software Download the latest version from the official website A China-Linked Backdoor Campaign Earlier this week, Kaspersky warned that Daemon Tools software installers distributed from the main website had been Trojanized since April 8.
campaign Campaign Earlier
The developer urged any user who downloaded the affected version to: Uninstall the application Run a full system scan using trusted security software Download the latest version from the official website A China-Linked Backdoor Campaign Earlier this week, Kaspersky warned that Daemon Tools software installers distributed from the main website had been Trojanized since April 8.
organisation China-Linked Backdoor Campaign
The developer urged any user who downloaded the affected version to: Uninstall the application Run a full system scan using trusted security software Download the latest version from the official website A China-Linked Backdoor Campaign Earlier this week, Kaspersky warned that Daemon Tools software installers distributed from the main website had been Trojanized since April 8.
organisation Kaspersky
The developer urged any user who downloaded the affected version to: Uninstall the application Run a full system scan using trusted security software Download the latest version from the official website A China-Linked Backdoor Campaign Earlier this week, Kaspersky warned that Daemon Tools software installers distributed from the main website had been Trojanized since April 8.
‎May 5
The Daemon Tools Lite software version 12.6 was released by Disc Soft less than 12 hours after being notified of a supply chain attack.
infrastructure 12.6
Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools Lite product on May 5, less than 12 hours after being notified of the supply chain attack.
general_metric 12.6 Version
Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools Lite product on May 5, less than 12 hours after being notified of the supply chain attack.
general_metric 12 hours
Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools Lite product on May 5, less than 12 hours after being notified of the supply chain attack.
‎May 7
Threat actors used Daemon Tools to target their internal infrastructure.
‎2026/05/07
Threat actors used Daemon Tools to infect victims across multiple countries, including Russia, Brazil, and Turkey.
infrastructure 12.5.1
“The affected version (12.5.1) has been removed and is no longer supported.
infrastructure 12.6.0
The latest version (12.6.0.2445) no longer exhibits the behavior associated with the incident.”
Tactical Metrics
Metrics
infrastructure
‎12.6
Software Version
Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools Lite product on May 5, less than 12 hours after being notified of the supply chain attack.
Metrics
infrastructure
‎12.5.1
Software Version
“The affected version (12.5.1) has been removed and is no longer supported.
Metrics
infrastructure
‎12.6.0
Software Version
The latest version (12.6.0.2445) no longer exhibits the behavior associated with the incident.”
Intelligence Sources
Infosecurity-Magazine 2026-05-07
Infosecurity-Magazine 2026-05-07