Kaspersky Reports Trojanized DAEMON Tools Installers Delivering Backdoor and QUIC RAT
Summary
Kaspersky reports that DAEMON Tools installers were trojanized from April 8, 2026. The signed installers delivered malware, with a backdoor and QUIC RAT reaching a limited number of targets.
Key points
- Versions 12.5.0.2421–12.5.0.2434 were reported compromised; the installers were distributed from the official site and signed with developer certificates.
- The tampered components are DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe.
- The implant contacts env-check[.]daemontools[.]cc for shell commands that download and run additional payloads.
- Kaspersky observed thousands of infection attempts, but the follow-on backdoor was delivered to about a dozen hosts.
- Affected organizations were reported in retail, scientific, government, and manufacturing sectors in Russia, Belarus, and Thailand.
- One backdoor payload was QUIC RAT, which supports multiple C2 protocols and can inject payloads into notepad.exe and conhost.exe.
- The activity has not been attributed to a known group; Kaspersky said artifacts point to a Chinese-speaking adversary, while the attacker’s intent remains unclear.
Article Details
- Event Type
- Software supply-chain attack involving trojanized DAEMON Tools installers distributed from the official website and signed with legitimate developer certificates.
- Impact
- Compromised installers in versions 12.5.0.2421–12.5.0.2434 activated an implant that could retrieve commands and download payloads. Kaspersky observed several thousand infection attempts across more than 100 countries, but reported that the follow-on backdoor reached only a dozen hosts; QUIC RAT was delivered to selected victims. Reported affected sectors included retail, scientific, government, and manufacturing organizations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | env-check[.]daemontools[.]cc | C2 domain contacted by the implant to retrieve shell commands. |
MITRE ATT&CK
T1055 · Process InjectionThe malware can inject payloads into notepad.exe and conhost.exe.T1059.003 · Windows Command ShellThe implant retrieves shell commands that are executed using cmd.exe.T1071.001 · Web ProtocolsThe implant uses an HTTP GET request to contact its C2 server.T1082 · System Information DiscoveryThe envchk.exe payload collects system information.T1105 · Ingress Tool TransferThe shell commands download executable payloads.
People
Anton KarginKaspersky researcher cited among the researchers who reported findings about the compromised DAEMON Tools installers.Georgy KucherinKaspersky researcher cited among the researchers who reported findings about the compromised installers; separately quoted as a senior security researcher discussing the incident.Igor KuznetsovKaspersky researcher cited among the researchers who reported findings about the compromised DAEMON Tools installers.Leonid BezvershenkoKaspersky researcher cited among the researchers who reported findings about the compromised DAEMON Tools installers.
Malware
Vendors
Products
Countries
BelarusThe systems that received the follow-on malware have been flagged as belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand.Brazilin its telemetry, impacting individuals and organizations in more than 100 countries, such as Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.Chinain more than 100 countries, such as Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.Franceindividuals and organizations in more than 100 countries, such as Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.Germanyindividuals and organizations in more than 100 countries, such as Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.Italyand organizations in more than 100 countries, such as Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.RussiaTools in its telemetry, impacting individuals and organizations in more than 100 countries, such as Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.Spainimpacting individuals and organizations in more than 100 countries, such as Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.ThailandThe systems that received the follow-on malware have been flagged as belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand.Turkeytelemetry, impacting individuals and organizations in more than 100 countries, such as Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.
Industries
GovernmentA selective follow-on delivery deployed QUIC RAT to a small number of targets across retail, scientific, government, and manufacturing sectors, with C2 supporting multiple protocols and process injection.ManufacturingA selective follow-on delivery deployed QUIC RAT to a small number of targets across retail, scientific, government, and manufacturing sectors, with C2 supporting multiple protocols and process injection.RetailA selective follow-on delivery deployed QUIC RAT to a small number of targets across retail, scientific, government, and manufacturing sectors, with C2 supporting multiple protocols and process injection.ScientificA selective follow-on delivery deployed QUIC RAT to a small number of targets across retail, scientific, government, and manufacturing sectors, with C2 supporting multiple protocols and process injection.