Supply‑Chain Attack Trojans DAEMON Tools Installers, Deploying Backdoor to High‑Value Targets
What Happened — Hackers compromised the official DAEMON Tools download site, inserting malicious code into installers (versions 12.5.0.2421‑12.5.0.2434). The trojanized binaries installed a persistence‑based backdoor on thousands of Windows machines in over 100 countries. A second‑stage payload was delivered to a select dozen high‑value victims, including retail, scientific, government, and manufacturing organizations.
Why It Matters for TPRM —
- Supply‑chain compromise bypasses traditional perimeter defenses, exposing any downstream vendor that distributes the software.
- The backdoor enables stealthy command‑and‑control, potentially leading to data exfiltration or sabotage of critical processes.
- High‑value targets indicate attackers are profiling victims before delivering advanced payloads, raising the risk profile of any organization using the tool.
Who Is Affected — Retail, scientific research, government agencies, and manufacturing firms that have installed DAEMON Tools on Windows endpoints.
Recommended Actions —
- Inventory all endpoints for DAEMON Tools installations and verify version numbers.
- Isolate and scan any systems with the affected binaries (DTHelper.exe, DiscSoftBusServiceLite.exe, DTShellHlp.exe).
- Apply endpoint detection and response (EDR) rules to detect the known backdoor behavior.
- Review third‑party software procurement policies to include integrity‑verification steps (e.g., hash validation, signed‑package verification).
Technical Notes —
- Attack vector: Trojans inserted into official installers (third‑party dependency).
- Payloads: First‑stage information stealer; second‑stage lightweight backdoor; occasional deployment of QUIC RAT (advanced remote access tool).
- Persistence: Backdoor registers to run at system startup.
- Data collected: Hostname, MAC address, process list, installed software, locale.
- Scope: >1,000 infections across 100+ countries; targeted second‑stage on ~12 systems.
Source: BleepingComputer