🤚 The Open-Palm Infection Report

If you downloaded DAEMON Tools between April 8 and early May 2026, congratulations — you may have also downloaded a state-sponsored backdoor, free of charge, from the official website. No shady forum required. No suspicious email attachment. Just the regular, legitimate download button you’ve been trusting since 2004.

According to Kaspersky, which disclosed the attack on May 5, hackers compromised the DAEMON Tools software supply chain and trojanized versions 12.5.0.2421 through 12.5.0.2434. The malicious code was embedded in three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe — names so boring that no human would ever think to question them.

The result: thousands of systems across more than 100 countries were infected with a first-stage payload that quietly collected hostnames, MAC addresses, running processes, installed software, and system locale. Because nothing says “welcome to your new ISO mounting experience” like a full inventory of your digital life being shipped to an unknown server.

👐 The Two-Handed Dissection

Here’s where the attack gets genuinely sophisticated — and genuinely terrifying. Of those thousands of infected machines, only about a dozen received the second-stage payload. The attackers weren’t running a dragnet. They were running a casting call.

The first stage profiled every victim. The second stage — a lightweight backdoor capable of executing commands, downloading files, and running code directly in memory — was reserved for “high-value targets” in the retail, scientific, government, and manufacturing sectors, specifically in Russia, Belarus, and Thailand. Because when you compromise a disc-image mounting tool used by millions, you don’t waste your premium malware on someone’s gaming PC. You pick your targets like a sommelier picks wine — selectively, and with contempt for the masses.

In at least one case, a more advanced strain called QUIC RAT was deployed, supporting multiple communication protocols and process injection. The name “QUIC RAT” sounds like something you’d order at a cyberpunk food truck, but its capabilities are decidedly less whimsical: full remote access, persistent presence, and the ability to hide in legitimate network traffic like a parasite in a pinstripe suit.

🌿 The Gentle Awakening

There’s a particular cruelty to supply chain attacks that other forms of cybercrime simply can’t match. Phishing asks you to make a mistake. Brute force asks you to use a weak password. A supply chain attack asks you to do exactly what you’re supposed to do — download software from its official source — and punishes you for your diligence.

DAEMON Tools has been a staple of the disc-image ecosystem for over two decades. It’s the kind of software that lives quietly in your system tray, minding its own business, mounting ISOs and virtual drives like a digital librarian. And now that librarian has been replaced by an imposter who looks identical, shelves the same books, and also photographs your passport while you’re not looking.

Kaspersky suspects a Chinese-speaking threat actor based on code strings found in the payload. Attribution in cybersecurity is always served with an asterisk, but the targeting pattern — government and scientific institutions in Russia and Belarus — paints a geopolitical picture that’s about as subtle as a supply chain attack that lasted nearly a month on an official website.

👑 The Gold-Leaf Reckoning

The uncomfortable truth about software supply chains is that they are held together by a combination of trust, underfunded security teams, and the collective delusion that “official” means “safe.” SolarWinds taught us this lesson in 2020. 3CX reinforced it in 2023. And now DAEMON Tools is the latest proof that the front door is sometimes the most dangerous entrance.

Kaspersky’s recommendation is almost poetic in its understatement: “organizations should carefully examine machines that had DAEMON Tools installed, for abnormal cybersecurity-related activities that occurred on or after April 8.” Translation: check everything. Trust nothing. Your ISO mounting utility may have been a foreign intelligence operation for the past month.

The attackers compromised a tool used by millions, infected thousands, and targeted a dozen. That funnel — from mass compromise to surgical extraction — is the hallmark of a patient, well-resourced adversary. The kind that doesn’t care about your Bitcoin wallet. The kind that cares about your classified research.

“The installer said ‘I Agree’ and so did the backdoor. Terms of service have never been more honest.” — The Slap of Wisdom Incident Response Team, currently mounting ISOs the old-fashioned way, which is to say not at all