Loading story…
Official Windows installers for DAEMON Tools were compromised in a supply chain attack, with malicious versions distributed from the vendor’s legitimate website beginning on April 8. Kaspersky said the trojanized installers affected DAEMON Tools Lite versions 12.5.0.2421 through 12.5.0.2434, were signed with valid AVB Disc Soft certificates, and implanted a staged backdoor that contacted the typosquatted command-and-control domain env-check.daemontools[.]cc. TechCrunch reported that an independently downloaded installer also appeared to contain the backdoor when scanned, while Disc Soft said it was investigating and taking remediation steps.
Researchers observed thousands of infection attempts across more than 100 countries, but the attackers appear to have selectively escalated only a small number of victims in Russia, Belarus, and Thailand. Follow-on activity targeted organizations in the government, scientific, manufacturing, and retail sectors and included additional payloads such as an information stealer, an in-memory backdoor using RC4, and a more advanced QUIC RAT. Kaspersky said Chinese-language artifacts in the malware suggest a Chinese-speaking threat actor may be involved, though attribution remains unconfirmed, and urged defenders to hunt for related hashes, suspicious DAEMON Tools process activity, and communications with env-check.daemontools[.]cc and 38.180.107[.]76.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
A Google Cloud Threat Intelligence blog attributed the early 2026 DAEMON Tools installer compromise to UNC6863. The post said the campaign deployed SLICKDEMON, BADFALL, and QUIC RAT against targets in multiple countries, adding a named actor attribution beyond earlier reporting.
After acknowledging the supply chain compromise, AVB Disc Soft released clean DAEMON Tools version 12.6.0.2445 to replace the trojanized installer range 12.5.0.2421 through 12.5.0.2434. The release marked the vendor's first specific remediation step beyond its initial investigation statement.
On publication day, Disc Soft said it was aware of the report, was investigating the issue, and was taking remediation steps, but had not yet confirmed all of the reported details. TechCrunch also independently downloaded the installer and observed signs of the backdoor via VirusTotal scanning.
In early May 2026, Kaspersky identified that official DAEMON Tools installers had been trojanized and linked the campaign to thousands of infection attempts across more than 100 countries. Malware analysis found Chinese-language artifacts, leading Kaspersky to suspect a Chinese-speaking threat actor, though attribution was not confirmed.
After initial infections, the attackers selectively deployed additional malware to a small subset of victims in Russia, Belarus, and Thailand, affecting organizations in government, scientific, manufacturing, and retail sectors. Later-stage payloads included an information stealer, an in-memory RC4-enabled backdoor, and QUIC RAT.
Kaspersky said the supply chain attack began on 2026-04-08, when official Windows installers for DAEMON Tools Lite started being distributed from the vendor's legitimate website with a malicious backdoor embedded. The affected installer range included versions 12.5.0.2421 through 12.5.0.2434 and the files were signed with valid AVB Disc Soft certificates.
Notepad++ published an incident update stating it had been hijacked by state-sponsored hackers. This is a separate software supply-chain/security incident from the DAEMON Tools compromise already captured in the timeline.
The FBI issued a public notice stating that North Korean TraderTraitor actors were responsible for the $1.5 billion Bybit hack and subsequent laundering activity. The bureau urged exchanges, RPC node operators, bridges, DeFi services, and blockchain analytics firms to block transactions tied to listed Ethereum addresses associated with the stolen assets.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 88 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
14 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourcecvefeed.io
Open sourceblog.polyswarm.io
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcenotepad-plus-plus.org
Open sourcefbi.gov
Open sourcesygnia.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026
Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including **Google Chrome**, **Microsoft Teams**, **Surfshark**, **Signal**, **Telegram**, **Zoom**, **DeepSeek**, **Quark Cloud**, and activation tools. The attacks rely on spoofed download sites and malicious `MSI` or `NSIS` packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the **Gh0st RAT** ecosystem, including modified Gh0st variants and **Atlas RAT**. Researchers linked the activity to Chinese-speaking threat actors including **Dragon Breath** and **Silver Fox**, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates. The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned `WDAC` policies to block Chinese antivirus tools, **Protected Process Light** abuse to corrupt **Microsoft Defender**'s `MsMpEng.exe`, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.
Aug 14, 2026
Multiple active malware campaigns are using **trojanized installers** and social engineering—rather than software vulnerabilities—to gain initial access and then deploy credential theft or remote-control capabilities. Intel 471 reported a new Android banking trojan dubbed **FvncBot** targeting Polish mobile banking users by impersonating an *mBank* “security” app; the dropper prompts installation of an additional “Play” component and then abuses **Android Accessibility Services** for persistence and control, enabling **keylogging**, **screen capture**, and hidden **VNC-style remote interaction** to facilitate fraudulent transactions. Separately, Cyderes described an ongoing, large-scale piracy-channel campaign where cracked game installers hide behind a legitimate-looking **Ren’Py** launcher tracked as **RenEngine**, which decrypts and launches subsequent stages and introduces **HijackLoader** via techniques including **DLL side-loading** and module stomping; observed final payloads include **ACR Stealer** (and in some cases **Vidar**) to exfiltrate browser credentials, cookies, and crypto wallet data. Cybereason detailed a different installer-themed operation in Chinese-speaking communities delivering **ValleyRat/Winos 4.0** attributed to **Silver Fox APT**, notable for using the rare **“PoolParty Variant 7”** process injection (abusing Windows I/O completion ports and `ZwSetIoCompletion()` after duplicating a handle from `Explorer.exe`) plus a strengthened watchdog mechanism via injection into `Explorer.exe` and `UserAccountBroker.exe` to maintain persistence.
Jun 29, 2026