Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack
Daemon Tools, a widely-used disk imaging application, was compromised in a month-long supply-chain attack affecting thousands of machines across 100+ countries, with digitally signed malicious updates distributed through official channels making detection extremely difficult. While most infected systems received only information-gathering payloads, approximately a dozen high-value targets in government, scientific, manufacturing, and retail sectors received sophisticated backdoors capable of remote command execution and code injection, indicating targeted espionage or credential theft intentions. This incident exemplifies the critical vulnerability of software supply chains and demonstrates that even official, signed updates cannot be implicitly trusted, requiring IT organizations to fundamentally reassess their patch management and endpoint monitoring strategies.
Daemon Tools, a widely used app for mounting disk images, has been backdoored in a monthlong compromise that has pushed malicious updates from the servers of its developer, researchers said Tuesday. Kaspersky, the security firm reporting the supply-chain attack, said it began on April 8 and remained active as of the time its post went live. Installers that are signed by the developer’s official digital certificate and downloaded from its website infect Daemon Tools executables, causing the malware to run at boot time. Kaspersky didn’t explicitly say so, but based on technical details, the infected versions appear to be only those that run on Windows. Versions 12.5.0.2421 through 12.5.0.2434 are affected. Neither Kaspersky nor developer AVB could be contacted immediately for additional details. Hard to defend against Infected versions contain an initial payload that collects MAC addresses, hostnames, DNS domain names, running processes, installed software, and system locales. The malware sends them to an attacker-controlled server. Thousands of machines in more than 100 countries were targeted. Out of the many machines infected, about 12 of them, belonging to retail, scientific, government and manufacturing organizations, have received a follow-on payload—an indication the supply-chain attack targets select groups.Read full article Comments
