Supply‑Chain Attack Trojans DAEMON Tools Installers, Deploying Backdoor to High‑Value Targets

Supply‑Chain Attack Trojans DAEMON Tools Installers, Deploying Backdoor to High‑Value Targets

What Happened — Hackers compromised the official DAEMON Tools download site, inserting malicious code into installers (versions 12.5.0.2421‑12.5.0.2434). The trojanized binaries installed a persistence‑based backdoor on thousands of Windows machines in over 100 countries. A second‑stage payload was delivered to a select dozen high‑value victims, including retail, scientific, government, and manufacturing organizations.

Why It Matters for TPRM —

• Supply‑chain compromise bypasses traditional perimeter defenses, exposing any downstream vendor that distributes the software.
• The backdoor enables stealthy command‑and‑control, potentially leading to data exfiltration or sabotage of critical processes.
• High‑value targets indicate attackers are profiling victims before delivering advanced payloads, raising the risk profile of any organization using the tool.

Who Is Affected — Retail, scientific research, government agencies, and manufacturing firms that have installed DAEMON Tools on Windows endpoints.

Recommended Actions —

• Inventory all endpoints for DAEMON Tools installations and verify version numbers.
• Isolate and scan any systems with the affected binaries (DTHelper.exe, DiscSoftBusServiceLite.exe, DTShellHlp.exe).
• Apply endpoint detection and response (EDR) rules to detect the known backdoor behavior.
• Review third‑party software procurement policies to include integrity‑verification steps (e.g., hash validation, signed‑package verification).

Technical Notes —

• Attack vector: Trojans inserted into official installers (third‑party dependency).
• Payloads: First‑stage information stealer; second‑stage lightweight backdoor; occasional deployment of QUIC RAT (advanced remote access tool).
• Persistence: Backdoor registers to run at system startup.
• Data collected: Hostname, MAC address, process list, installed software, locale.
• Scope: >1,000 infections across 100+ countries; targeted second‑stage on ~12 systems.

Source: BleepingComputer