DAEMON Tools (Disc Soft) — trojanised signed installers

What happened

Between 8 April and 5 May 2026, the official installer for DAEMON Tools Lite — distributed from the vendor’s own website at daemon-tools.cc — was a malicious build. The trojanised installers spanned versions 12.5.0.2421 through 12.5.0.2434, and every copy was signed with a valid digital certificate belonging to the developer, AVB Disc Soft. Kaspersky’s Global Research and Analysis Team disclosed the compromise on 5 May after several weeks of internal investigation, and Disc Soft shipped a clean version, 12.6.0.2445, the same day.

DAEMON Tools is a long-running consumer Windows utility for mounting disc images, with a freemium “Lite” edition that is the most widely deployed of the family. Kaspersky telemetry placed infection attempts across more than a hundred countries and several thousand individual machines, with home users accounting for the majority of installs. Around ten per cent of detected installations sat inside organisations, and the second-stage payload — a remote-access trojan referred to by Kaspersky as QUIC RAT — was delivered only to a few dozen of those: a selection of government, scientific-research, manufacturing and retail targets in Russia, Belarus and Thailand. The targeting profile is the strongest signal in the case. The bulk infection looks like opportunistic distribution; the second-stage delivery looks like espionage with a pre-selected list.

CISA added CVE-2026-8398, the “DAEMON Tools Lite Embedded Malicious Code Vulnerability,” to its Known Exploited Vulnerabilities catalogue on 27 May, with a remediation deadline for US federal agencies of 10 June. The KEV addition arrived alongside two unrelated developer-tooling compromises (TanStack and Nx Console), framing 27 May as a single CISA-led acknowledgement that the software supply chain is now where federal exploitation pressure sits.

How it worked

The malicious payload was implanted in the C run-time initialisation code of three signed Disc Soft binaries shipped inside the installer: DTHelper.exe, DiscSoftBusServiceLite.exe and DTShellHlp.exe. Because the implant lives in CRT init, it executes before main() — every time any of the three binaries is started, the backdoor runs first, irrespective of how DAEMON Tools itself is used. DiscSoftBusServiceLite.exe runs as a Windows service that starts on every boot, which gave the attacker persistence on any infected machine without needing to drop additional artefacts.

The first-stage backdoor issues an HTTPS GET to env-check.daemontools[.]cc, a domain registered on 27 March 2026 — twelve days before the first malicious installer shipped, which is itself the cleanest timeline indicator that the campaign was planned end-to-end. The C2 response is a shell command, executed via cmd.exe. For most infected endpoints, no further command was issued: the backdoor checked in and the attacker moved on. For the small set of selected organisational targets, the response delivered QUIC RAT.

QUIC RAT, named for the QUIC transport protocol it uses for command-and-control, is a fuller remote-access tool. It supports multiple C2 transport options for resilience, injects itself into notepad.exe and conhost.exe — long-running, trusted Windows processes that defenders are unlikely to allowlist against — and provides the attacker with arbitrary command execution, file operations and outbound data movement. The injection pattern is the operational tell: a defender looking only at signed-process behaviour will see DiscSoftBusServiceLite.exe behaving normally and notepad.exe behaving abnormally, but the notepad.exe activity is the attacker’s. EDR detections that lean on “did the parent process change” or “is this process talking to a domain registered six weeks ago” are the most reliable late catches, and were the basis of Kaspersky’s eventual disclosure.

Compromise of the build or signing pipeline at Disc Soft is the most consistent explanation for trojanised binaries shipping under valid certificates from the vendor’s own download endpoint, but Disc Soft has not published a technical post-mortem and Kaspersky’s research stops short of asserting which control failed at the vendor. Code-signing artefacts inside the implant suggest the threat actor is Chinese-speaking, and the targeting pattern (Russia, Belarus, Thailand) is consistent with espionage rather than financial extortion, but no public attribution to a named cluster has been issued.

Timeline

• 27 March 2026 — env-check.daemontools[.]cc registered for command-and-control.
• 8 April 2026 — first trojanised DAEMON Tools Lite installer (12.5.0.2421) ships from the vendor’s website.
• 8 April – 5 May 2026 — versions 12.5.0.2421 through 12.5.0.2434 are distributed from the official download endpoint; several thousand infection attempts observed in over a hundred countries.
• Mid-to-late April 2026 — Kaspersky telemetry flags anomalous behaviour from signed Disc Soft binaries; internal investigation opens.
• 5 May 2026 — Kaspersky publishes the Securelist write-up and accompanying press release; Disc Soft ships a clean version (12.6.0.2445).
• 27 May 2026 — CISA adds CVE-2026-8398 to its Known Exploited Vulnerabilities catalogue; federal agency remediation deadline set at 10 June 2026.
• 10 June 2026 — CISA federal deadline.

What defenders should learn

The control most people reach for when they hear “supply-chain compromise of a signed installer” — code-signing trust — is exactly the control the attacker has compromised. The signature on DTHelper.exe was valid because it was Disc Soft’s signature; the installer downloaded from the vendor’s own website was the malicious copy. Any allowlist that says “if it’s signed by Disc Soft, it runs,” and most do, was the wrong answer the entire time. The lever for the next month of these — and the eScan, Notepad++ and CPUID compromises earlier in 2026 mean there will be more — is reducing the blast radius of any one signed binary that the organisation has already chosen to trust.

The first cheap lever is application allowlisting at the buyer’s edge. The consumer-grade utilities that keep appearing as supply-chain victims (DAEMON Tools, Notepad++ alternatives, system-information tools) are rarely needed on the endpoints where this matters. A government, scientific-research or manufacturing endpoint with no business reason to mount disc images is the same endpoint that Kaspersky telemetry shows received the QUIC RAT payload. The compromise is the vendor’s problem, but the installation footprint is the buyer’s choice.

The second lever is process-behaviour rather than process-signature. Watching for notepad.exe issuing outbound connections, for conhost.exe spawning unusual child processes, and for newly registered C2 domains being contacted by long-lived signed services is detection that does not depend on the certificate chain holding. EDR products carry this telemetry already; the operational question is whether the SOC is tuned to act on it before the second stage lands.

The third lever is the one we keep coming back to, and it is left lighter here on purpose. A signed binary that calls a freshly registered external domain is exactly the kind of east-west move that segmentation makes visible at the network layer. The certificate may say the binary is trustworthy; the egress policy is the place to decide whether trustworthy means “may reach the internet on arbitrary ports to a six-week-old domain.” Increasingly, it should not.