Kaspersky suspects Chinese hackers planted a backdoor into Daemon Tools in ‘widespread’ attack

Kaspersky, the renowned cybersecurity firm, has reported the discovery of a malicious backdoor embedded in the widely used Windows disc imaging software, Daemon Tools. On Tuesday, the company revealed that its antivirus data indicates a significant ongoing attack, impacting numerous computers globally that utilize this software. The threat is believed to be linked to a group of hackers who speak Chinese, as suggested by the analysis of the malware. This backdoor has allowed the attackers to deploy additional malicious software on various computers within retail, scientific, manufacturing sectors, and even government systems. According to Kaspersky, the nature of the attacks suggests a deliberate targeting of specific organizations located in Russia, Belarus, and Thailand. The malicious backdoor was first detected on April 8, and Kaspersky has reached out to Disc Soft, the developer behind Daemon Tools, though it remains unclear if they have responded or taken any remedial actions. Alarmingly, Kaspersky noted that this supply chain attack is still active, meaning the hackers retain the ability to introduce malware into thousands of computers running Daemon Tools. This incident is part of a troubling trend of supply chain attacks that have surged in recent months, where hackers exploit access to developers' accounts to inject harmful code into widely used software. This tactic enables them to compromise a vast number of systems simultaneously when updates are pushed to users. Earlier this year, a similar incident saw hackers linked to the Chinese government exploit the popular Notepad++ software to spread malware among organizations focused on East Asia. In another recent incident, cybercriminals targeted users visiting the CPUID website, which is known for its HWMonitor and CPU-Z tools. A check by TechCrunch of the Windows installer from Daemon Tools revealed the presence of the backdoor via the VirusTotal malware scanning service. It remains uncertain whether the macOS version of Daemon Tools or other applications from Disc Soft have been compromised. A representative from Disc Soft acknowledged awareness of the situation and stated that they are actively investigating the report. They emphasized their commitment to addressing the issue with utmost priority, although they could not confirm specific details at this time. As this situation develops, Kaspersky is urging users affected by the cyberattack to share their experiences, particularly if they received antivirus alerts indicating they were impacted. For secure communication, users can reach out via the provided Signal username.