Home / Technology / Malware Hijacks Software Downloads for Weeks
Malware Hijacks Software Downloads for Weeks
6 May
Summary
- Malware was distributed via official DAEMON Tools downloads for nearly a month.
- The attack infiltrated the developer's IT systems in Latvia.
- Over 100 countries were affected by the supply chain attack.
A significant supply chain attack has been ongoing for nearly a month, with malware undetected in downloads of DAEMON Tools. The compromised software, versions 12.5.0.2421 to 12.5.0.2434, was distributed from the official vendor site, daemon-tools.cc, beginning on April 8.
This attack involved infiltrating the IT systems of AVB Disc Soft, the Latvian developer behind DAEMON Tools. The malicious installers contained rigged executables designed to install backdoors on Windows PCs. The compromised software was digitally signed by the developer, and evidence suggests a Chinese-speaking hacker group is responsible.
DAEMON Tools confirmed the breach, stating unauthorized interference impacted their build environment. They have since removed all compromised files and released a new, malware-free version, 12.6, on Tuesday. Other DAEMON Tools products remain unaffected and safe to use.
Kaspersky's data indicates the malware spread to users and organizations in over 100 countries, with significant impact in Russia, Brazil, and Turkey, among others. While widespread infections occurred, further-stage payloads were deployed to a limited number of targeted machines in retail, scientific, government, and manufacturing sectors.
