DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware

Kaspersky discovered a supply-chain attack that trojanized DAEMON Tools installers (signed and served from the official site) between versions 12.5.0.2421–12.5.0.2434 beginning April 8, 2026, activating an implant that contacts env-check.daemontools.cc to fetch commands and deliver a multi-stage payload (envchk.exe, cdg.exe/cdg.tmp, and backdoors including QUIC RAT). Telemetry shows several thousand infection attempts across 100+ countries, with targeted second-stage backdoor deployment to about a dozen high-value hosts in retail, scientific, government, and manufacturing sectors; the malware supports many C2 channels and process injection, indicating a sophisticated adversary and active supply-chain compromise.