DAEMON Tools Lite CVE-2026-8398: Backdoored Installers

What to do

1. Find every Windows machine with DAEMON Tools Lite installed and flag any build from 12.5.0.2421 to 12.5.0.2434.
2. Isolate flagged machines and collect EDR, PowerShell and Temp-folder evidence before cleaning them.
3. Uninstall the affected build, run a full antivirus scan, and reinstall 12.6.0.2445 or later from the official site only if it is still needed.
4. Rebuild any machine that shows a second-stage payload, and rotate credentials that were used on it.
5. Block env-check.daemontools[.]cc and 38.180.107[.]76 at DNS and egress.

How to check if you are affected or compromised

• Search DNS, proxy and firewall logs from April 8, 2026 onward for env-check.daemontools[.]cc and 38.180.107[.]76.
• Look for C:\Windows\Temp\envchk.exe, cdg.exe or cdg.tmp, C:\ProgramData\Microsoft\mcrypto.chiper and %APPDATA%\Microsoft\mcrypto.dat, and compare file hashes with Kaspersky's SHA-1 list.
• Hunt for DTHelper.exe, DiscSoftBusServiceLite.exe or DTShellHlp.exe spawning cmd.exe or PowerShell with System.Net.WebClient DownloadFile (events 4688 and 4104).
• Check for rundll32.exe loading mcrypto.chiper and for code injection into notepad.exe or conhost.exe.

What happened#

On May 5, 2026, Kaspersky reported that official DAEMON Tools Lite installers had carried a backdoor since April 8. The installers came from the developer's own website and were signed with the developer's certificates. Kaspersky identified versions 12.5.0.2421 to 12.5.0.2434 as compromised. Three binaries were trojanized: DTHelper.exe, DiscSoftBusServiceLite.exe and DTShellHlp.exe. Each one starts at boot. The implant sits in the program's startup code and sends the computer's full name to env-check.daemontools[.]cc, a lookalike of the real daemon-tools.cc domain that was registered on March 27. The server can reply with a shell command that downloads and runs a payload from 38.180.107[.]76.

The developer, Disc Soft Limited, issued a statement on May 6. It said "unauthorized interference within our infrastructure" meant that "certain installation packages were impacted within our build environment and were released in a compromised state." It shipped a clean 12.6 on May 5, within 12 hours of being notified; the current build is 12.6.0.2445. Neither the vendor nor Kaspersky attributes the attack, though Kaspersky found Chinese strings in one payload.

Kaspersky, acting as CNA, published CVE-2026-8398 (CWE-506, embedded malicious code) on May 15. It scores the CVE 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. NVD lists only those scores. CISA added it to KEV on May 27, with a May 30 deadline.

Who is affected#

Windows machines that installed DAEMON Tools Lite from roughly April 8 to May 5, 2026. Disc Soft calls the affected release 12.5.1 (free). It says paid Lite, Ultra and Pro were not affected. Kaspersky saw several thousand infection attempts in more than 100 countries. Most victims got only an information collector, which reports the MAC address, hostname, domain, running processes, installed software and locale. About a dozen machines at government, scientific, manufacturing and retail organizations in Russia, Belarus and Thailand received a further backdoor. One Russian educational institution received QUIC RAT (coverage).

Do you really need to act?#

If no machine ever had a 12.5.0.24xx build, no. If one did, yes, even five months later. Upgrading to 12.6 replaces the trojanized files but cannot undo what already ran. The collector reported back, and the attacker chose which machines got a second stage. Kaspersky advises examining DAEMON Tools machines for suspicious activity "on or after April 8." Signature checks will not help, because the bad files carry the vendor's valid signature. Search the whole fleet.

What to do now#

1. Find installs: Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*DAEMON Tools*' | Select-Object DisplayName, DisplayVersion.
2. On flagged machines, hash the binaries with Get-FileHash -Algorithm SHA1 'C:\Program Files\DAEMON Tools Lite\*.exe' and compare against Kaspersky's list. Isolate the machine and collect evidence before cleaning it.
3. Follow the vendor's steps: uninstall, run a full scan, and reinstall 12.6.0.2445 or later only if you still need it.
4. Rebuild any machine with second-stage files, and rotate the credentials used on it.
5. Block the domain and IP at egress.

How to tell if you were hit#

Search DNS and proxy logs from April 8 onward for env-check.daemontools[.]cc and 38.180.107[.]76. On disk, look for C:\Windows\Temp\envchk.exe, cdg.exe, cdg.tmp, C:\ProgramData\Microsoft\mcrypto.chiper and %APPDATA%\Microsoft\mcrypto.dat. In process and PowerShell logs (events 4688 and 4104), look for DAEMON Tools binaries spawning cmd.exe or PowerShell that calls System.Net.WebClient DownloadFile. Also look for rundll32.exe loading mcrypto.chiper, and for injection into notepad.exe or conhost.exe. A second-stage file means a targeted, hands-on intrusion.

Timeline#

• Mar 27, 2026 — The lookalike domain is registered, per Kaspersky.
• Apr 8, 2026 — The first trojanized build ships from the official site.
• May 5, 2026 — Kaspersky publishes its report. The vendor is notified around 07:00 GMT and releases 12.6.
• May 6, 2026 — Disc Soft publishes its statement. Kaspersky says 12.6.0.2445 lacks the malicious behavior.
• May 15, 2026 — CVE-2026-8398 is published.
• May 27, 2026 — CISA adds the CVE to KEV, with a May 30 deadline.

Vulnerability records

• CVE-2026-8398 · KEV 2026-05-27 · A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Disc Soft — Security Incident Affecting DAEMON Tools Lite: What We Know So Far blog.daemon-tools.cc
2. Kaspersky Securelist — DAEMON Tools software infected: supply chain attack ongoing since April 8, 2026 securelist.com
3. CVE record — CVE-2026-8398 cve.org
4. NVD — CVE-2026-8398 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-8398 cisa.gov

Coverage and analysis

1. Help Net Security — Attackers compromised Daemon Tools software to deliver backdoors helpnetsecurity.com