Poisoned Pipeline / Incidents / AS195
DAEMON Tools signed installers backdoored (Apr–May 2026)
Windows softwareInstaller / update channel
Kaspersky Securelist (5 May 2026): DAEMON Tools Lite installers 12.5.0.2421
through 12.5.0.2434, distributed from the vendor site and signed by AVB
Disc Soft, carried a backdoor in DTHelper.exe, DiscSoftBusServiceLite.exe
and DTShellHlp.exe from 8 April. Thousands of infection attempts in 100+
countries; further-stage payloads on only about a dozen machines (retail,
scientific, government, manufacturing). GTIG tracks the actor as UNC6863
(SLICKDEMON / BADFALL / QUIC RAT). Vendor shipped 12.6.0.2445 without the
malicious behavior.
Mapped techniques
- T0121 Compromised legitimate artifact
- T0208 Compromise code-signing identity
- T0138 Backdoor in code
- T0159 Malicious artifact execution
supply-chain signed vendor installer
Official DAEMON Tools installers from daemon-tools.cc.
Binaries signed with AVB Disc Soft certificates.
Backdoor in helper/service binaries at startup.
Ran with the legitimate installer.