As cited
Copy frozen at (site build).
breaches incidents
Risky Bulletin: Extremely targeted supply chain attack hits DAEMON Tools
DAEMON Tools, a widely-used disc and bootable USB creation utility, has been distributing signed installers containing a backdoor since at least April 8. The malware executes on every system startup, collecting system information including MAC address, hostname, locale, DNS domain, active processes, and installed software, then transmitting it to a remote server. The use of legitimate vendor certificates indicates the attackers achieved significant access to the software publisher's internal build and signing infrastructure.
Why it matters: If your organization uses DAEMON Tools, verify whether affected versions were deployed and audit those systems for reconnaissance activity and lateral movement from the compromise window.
- Source published
- First seen by Cybersecurity Tracker