Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack
Government, scientific, manufacturing, and retail organizations have been targeted with a sophisticated backdoor in an ongoing supply chain attack involving the Daemon Tools disk imaging software, Kaspersky reports.
As part of the attack, Chinese-speaking attackers apparently injected malicious code into multiple Daemon Tools iterations that have been available for download via the software’s legitimate website.
Daemon Tools versions 12.5.0.2421 to 12.5.0.2434, released since April 8, have been found to contain injected code, and the attack remains active, Kaspersky says. AVB Disc Soft, the company behind Daemon Tools, has been notified.
As part of the supply chain attack, the threat actors compromised three binaries within the software, namely DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe, all signed using certificates belonging to AVB Disc Soft.
“Whenever one of these binaries is launched, which happens at the machine startup, a backdoor gets activated. This backdoor is implanted in the startup code responsible for initializing the...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
