Compromised DAEMON Tools Installers Deliver Malware in Targeted Supply-Chain Attack
Summary
Kaspersky reports that trojanized DAEMON Tools versions 12.5.0.2421–12.5.0.2434 have distributed malware since April 8, 2026. The active campaign uses compromised installers to deliver targeted payloads and communicate with env-check[.]daemontools[.]cc.
Key points
- The article reports thousands of infection attempts across more than 100 countries; targeted follow-on payloads reached a small number of organizations in Russia, Belarus, and Thailand.
- Versions 12.5.0.2421–12.5.0.2434 were affected. Three tampered binaries—DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe—retained valid developer signatures.
- On execution, the implant contacts env-check[.]daemontools[.]cc over HTTP to receive shell commands executed through cmd.exe.
- Reported payloads include envchk.exe for system information collection and a loader that executes a backdoor capable of downloading files, running commands, and executing shellcode in memory.
- QUIC RAT was recorded targeting a Russian educational institution. The article describes its support for multiple C2 protocols and process-injection capabilities.
- The article recommends isolating machines with DAEMON Tools, checking for suspicious activity since April 8, blocking the C2 domain, and monitoring for compromised binaries and associated payloads. It advises awaiting official guidance or patched releases before enterprise reinstallation.
Article Details
- Attack Vectors
- Trojanized official DAEMON Tools installers distributed malware through legitimate software channels.
- Compromised binaries activated an implant when launched, typically during system startup.
- The implant contacted a command-and-control server over HTTP and received shell commands executed via cmd.exe.
- Follow-on payloads included a system-information collector and a shellcode loader that decrypted and executed a backdoor.
- QUIC RAT was reported to use process injection targeting notepad.exe and conhost.exe.
- Defensive Notes
- Isolate machines with DAEMON Tools installed and investigate suspicious activity beginning April 8, 2026.
- Block traffic to env-check.daemontools[.]cc.
- Monitor execution of DTHelper.exe, DiscSoftBusServiceLite.exe, DTShellHlp.exe, envchk.exe, cdg.exe, and cdg.tmp.
- The article advises waiting for official guidance or patched releases from AVB Disc Soft before reinstalling DAEMON Tools in enterprise environments.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | env-check[.]daemontools[.]cc | C2 domain contacted by the implant to receive shell commands. |
| IPV4 | 38[.]180[.]107[.]76 | Listed as a C2 indicator in the article. |
| SHA1 | 00e2df8f42d14072e4385e500d4669ec783aa517 | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | 0456e2f5f56ec8ed16078941248e7cbba9f1c8eb | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | 0c1d3da9c7a651ba40b40e12d48ebd32b3f31820 | Hash of an infected DAEMON Tools Lite installer, version 12.5.0.2423. |
| SHA1 | 15ed5c3384e12fe4314ad6edbd1dcccf5ac1ee29 | Hash of an infected DAEMON Tools Lite installer, version 12.5.0.2434. |
| SHA1 | 28b72576d67ae21d9587d782942628ea46dcc870 | Hash of an infected DAEMON Tools Lite installer, version 12.5.0.2424. |
| SHA1 | 295ce86226b933e7262c2ce4b36bdd6c389aaaef | Hash listed among indicators for the attack's payload artifacts. |
| SHA1 | 2d4eb55b01f59c62c6de9aacba9b47267d398fe4 | Hash listed for envchk.exe, a payload described as a .NET system-information collector. |
| SHA1 | 427f1728682ebc7ffe3300fef67d0e3cb6b62948 | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | 46b90bf370e60d61075d3472828fdc0b85ab0492 | Hash of an infected DAEMON Tools Lite installer, version 12.5.0.2430. |
| SHA1 | 50d47adb6dd45215c7cb4c68bae28b129ca09645 | Hash of an infected DAEMON Tools Lite installer, version 12.5.0.2422. |
| SHA1 | 524d2d92909eef80c406e87a0fc37d7bb4dadc14 | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | 6325179f442e5b1a716580cd70dea644ac9ecd18 | Hash of an infected DAEMON Tools Lite installer, version 12.5.0.2431. |
| SHA1 | 64462f751788f529c1eb09023b26a47792ecdc54 | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | 8d435918d304fc38d54b104a13f2e33e8e598c82 | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | 8e7eb0f5ac60dd3b4a9474d2544348c3bda48045 | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | 9a09ad7b7e9ff7a465aa1150541e231189911afb | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | 9ccd769624de98eeeb12714ff1707ec4f5bf196d | Hash of an infected DAEMON Tools Lite installer, version 12.5.0.2421. |
| SHA1 | 9dbfc23ebf36b3c0b56d2f93116abb32656c42e4 | Hash listed among indicators for the attack's payload artifacts. |
| SHA1 | aea55e42c4436236278e5692d3dcbcbe5fe6ce0b | Hash listed for a modified DiscSoftBusServiceLite.exe. |
| SHA1 | bd8fbb5e6842df8683163adbd6a36136164eac58 | Hash of an infected DAEMON Tools Lite installer, version 12.5.0.2433. |
MITRE ATT&CK
T1055 · Process InjectionQUIC RAT is reported to have process-injection capabilities targeting notepad.exe and conhost.exe.T1059.003 · Windows Command ShellThe implant's received shell commands are executed via cmd.exe.T1071.001 · Web ProtocolsThe implant sends an HTTP GET request to its C2 domain to receive commands.T1082 · System Information DiscoveryThe envchk.exe payload is designed to collect extensive system information.T1105 · Ingress Tool TransferThe cdg backdoor is described as capable of downloading files.T1195.002 · Compromise Software Supply ChainThe attackers compromised official DAEMON Tools installers and distributed trojanized versions through the software's legitimate distribution channels.
Malware
Vendors
Products
Countries
BelarusTargeted follow-on payloads have been delivered to a small number of hosts belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand.BrazilThousands of infection attempts have been observed across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.ChinaThousands of infection attempts have been observed across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.FranceThousands of infection attempts have been observed across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.GermanyThousands of infection attempts have been observed across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.ItalyThousands of infection attempts have been observed across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.RussiaThousands of infection attempts have been observed across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.SpainThousands of infection attempts have been observed across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.ThailandTargeted follow-on payloads have been delivered to a small number of hosts belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand.TurkeyThousands of infection attempts have been observed across more than 100 countries, including Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.
Industries
GovernmentTargeted follow-on payloads have been delivered to a small number of hosts belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand.ManufacturingTargeted follow-on payloads have been delivered to a small number of hosts belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand.RetailTargeted follow-on payloads have been delivered to a small number of hosts belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand.ScientificTargeted follow-on payloads have been delivered to a small number of hosts belonging to retail, scientific, government, and manufacturing organizations in Russia, Belarus, and Thailand.