AnalysisPublished 5 May 2026

Supply chain attack via DAEMON Tools | Kaspersky official blog

Source Kaspersky Security Blog

Description

Kaspersky experts have detected a supply chain attack using the popular DAEMON Tools software.

Impact

The attack compromises the integrity of DAEMON Tools installers, leading to the installation of persistent malware that can gather sensitive system information and enable remote control via a backdoor and advanced RAT. This allows attackers to execute arbitrary commands, deploy additional malicious payloads, and potentially maintain long-term access to infected systems. The infection affects both home users and organizations, including government and scientific sectors, increasing the risk of espionage or data theft. The widespread geographic distribution includes Russia, Brazil, Turkey, Spain, Germany, France, Italy, China, Belarus, and Thailand. The attack undermines trust in the software supply chain and poses a significant risk to affected users.

Defensive guidance

Users and organizations using DAEMON Tools should thoroughly check systems for unusual activity starting from April 8, 2026. Employing reliable security solutions is recommended, as Kaspersky's products have been effective in detecting and blocking the malware involved in this supply chain attack. Users should avoid installing or reinstalling affected versions (12.5.0.2421 to 12.5.0.2434) until the vendor provides an official fix or advisory. Monitoring for indicators of compromise as detailed in the Kaspersky report is advised.

References

kaspersky.com/blog/daemon-tools-supply-chain-attack/55691/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 May 2026, 12:23 UTC

References

Community reviews