---
title: "DAEMON Tools Lite CVE-2026-8398: Backdoored Installers"
url: https://erroneo.us/security/briefs/daemon-tools-lite-cve-2026-8398-supply-chain-backdoor/
description: "Signed DAEMON Tools Lite 12.5.0.2421-2434 installers carried a backdoor Apr 8-May 5, 2026. Fixed in 12.6.0.2445. Treat any such install as compromised."
type: security-brief
section: "Security Digest"
date_published: 2026-05-05
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-8398"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# DAEMON Tools Lite CVE-2026-8398: Backdoored Installers

**Verdict: Check exposure.** Only Windows machines that installed the free DAEMON Tools Lite between April 8 and May 5, 2026 are affected, but each one should be investigated as compromised, not just updated.

- **Who must act:** Anyone with Windows machines that installed DAEMON Tools Lite 12.5.0.2421 through 12.5.0.2434 from daemon-tools.cc between April 8 and May 5, 2026.
- **Who can relax:** Users of DAEMON Tools Ultra, DAEMON Tools Pro and paid DAEMON Tools Lite, which the vendor says were not affected, and machines that never ran a 12.5.0.24xx build.
- **Affected:** DAEMON Tools Lite for Windows 12.5.0.2421 through 12.5.0.2434, distributed from about April 8 to May 5, 2026 (the vendor calls this release 12.5.1, free edition)
- **Fixed:** DAEMON Tools Lite 12.6.0.2445 or later (12.6 released May 5, 2026)
- **CVEs:** CVE-2026-8398
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Windows machine with DAEMON Tools Lite installed and flag any build from 12.5.0.2421 to 12.5.0.2434.
2. Isolate flagged machines and collect EDR, PowerShell and Temp-folder evidence before cleaning them.
3. Uninstall the affected build, run a full antivirus scan, and reinstall 12.6.0.2445 or later from the official site only if it is still needed.
4. Rebuild any machine that shows a second-stage payload, and rotate credentials that were used on it.
5. Block env-check.daemontools[.]cc and 38.180.107[.]76 at DNS and egress.

### How to check if you are affected

- Search DNS, proxy and firewall logs from April 8, 2026 onward for env-check.daemontools[.]cc and 38.180.107[.]76.
- Look for C:\Windows\Temp\envchk.exe, cdg.exe or cdg.tmp, C:\ProgramData\Microsoft\mcrypto.chiper and %APPDATA%\Microsoft\mcrypto.dat, and compare file hashes with Kaspersky's SHA-1 list.
- Hunt for DTHelper.exe, DiscSoftBusServiceLite.exe or DTShellHlp.exe spawning cmd.exe or PowerShell with System.Net.WebClient DownloadFile (events 4688 and 4104).
- Check for rundll32.exe loading mcrypto.chiper and for code injection into notepad.exe or conhost.exe.

## What happened

On May 5, 2026, [Kaspersky reported](https://securelist.com/tr/daemon-tools-backdoor/119654/) that official DAEMON Tools Lite installers had carried a backdoor since April 8. The installers came from the developer's own website and were signed with the developer's certificates. Kaspersky identified versions 12.5.0.2421 to 12.5.0.2434 as compromised. Three binaries were trojanized: `DTHelper.exe`, `DiscSoftBusServiceLite.exe` and `DTShellHlp.exe`. Each one starts at boot. The implant sits in the program's startup code and sends the computer's full name to `env-check.daemontools[.]cc`, a lookalike of the real daemon-tools.cc domain that was registered on March 27. The server can reply with a shell command that downloads and runs a payload from `38.180.107[.]76`.

The developer, Disc Soft Limited, issued a [statement](https://blog.daemon-tools.cc/post/security-incident) on May 6. It said "unauthorized interference within our infrastructure" meant that "certain installation packages were impacted within our build environment and were released in a compromised state." It shipped a clean 12.6 on May 5, within 12 hours of being notified; the current build is 12.6.0.2445. Neither the vendor nor Kaspersky attributes the attack, though Kaspersky found Chinese strings in one payload.

Kaspersky, acting as CNA, published [CVE-2026-8398](https://www.cve.org/CVERecord?id=CVE-2026-8398) (CWE-506, embedded malicious code) on May 15. It scores the CVE 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-8398) lists only those scores. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398) on May 27, with a May 30 deadline.

## Who is affected

Windows machines that installed DAEMON Tools Lite from roughly April 8 to May 5, 2026. Disc Soft calls the affected release 12.5.1 (free). It says paid Lite, Ultra and Pro were not affected. Kaspersky saw several thousand infection attempts in more than 100 countries. Most victims got only an information collector, which reports the MAC address, hostname, domain, running processes, installed software and locale. About a dozen machines at government, scientific, manufacturing and retail organizations in Russia, Belarus and Thailand received a further backdoor. One Russian educational institution received QUIC RAT ([coverage](https://www.helpnetsecurity.com/2026/05/06/daemon-tools-compromised-backdoors-supply-chain-attack/)).

## Do you really need to act?

If no machine ever had a 12.5.0.24xx build, no. If one did, yes, even five months later. Upgrading to 12.6 replaces the trojanized files but cannot undo what already ran. The collector reported back, and the attacker chose which machines got a second stage. Kaspersky advises examining DAEMON Tools machines for suspicious activity "on or after April 8." Signature checks will not help, because the bad files carry the vendor's valid signature. Search the whole fleet.

## What to do now

1. Find installs: `Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*DAEMON Tools*' | Select-Object DisplayName, DisplayVersion`.
2. On flagged machines, hash the binaries with `Get-FileHash -Algorithm SHA1 'C:\Program Files\DAEMON Tools Lite\*.exe'` and compare against Kaspersky's list. Isolate the machine and collect evidence before cleaning it.
3. Follow the vendor's steps: uninstall, run a full scan, and reinstall 12.6.0.2445 or later only if you still need it.
4. Rebuild any machine with second-stage files, and rotate the credentials used on it.
5. Block the domain and IP at egress.

## How to tell if you were hit

Search DNS and proxy logs from April 8 onward for `env-check.daemontools[.]cc` and `38.180.107[.]76`. On disk, look for `C:\Windows\Temp\envchk.exe`, `cdg.exe`, `cdg.tmp`, `C:\ProgramData\Microsoft\mcrypto.chiper` and `%APPDATA%\Microsoft\mcrypto.dat`. In process and PowerShell logs (events 4688 and 4104), look for DAEMON Tools binaries spawning `cmd.exe` or PowerShell that calls `System.Net.WebClient` `DownloadFile`. Also look for `rundll32.exe` loading `mcrypto.chiper`, and for injection into `notepad.exe` or `conhost.exe`. A second-stage file means a targeted, hands-on intrusion.

## Timeline

- Mar 27, 2026 — The lookalike domain is registered, per Kaspersky.
- Apr 8, 2026 — The first trojanized build ships from the official site.
- May 5, 2026 — Kaspersky publishes its report. The vendor is notified around 07:00 GMT and releases 12.6.
- May 6, 2026 — Disc Soft publishes its statement. Kaspersky says 12.6.0.2445 lacks the malicious behavior.
- May 15, 2026 — CVE-2026-8398 is published.
- May 27, 2026 — CISA adds the CVE to KEV, with a May 30 deadline.

## Sources

1. [Disc Soft — Security Incident Affecting DAEMON Tools Lite: What We Know So Far](https://blog.daemon-tools.cc/post/security-incident)
2. [Kaspersky Securelist — DAEMON Tools software infected: supply chain attack ongoing since April 8, 2026](https://securelist.com/tr/daemon-tools-backdoor/119654/)
3. [CVE record — CVE-2026-8398](https://www.cve.org/CVERecord?id=CVE-2026-8398)
4. [NVD — CVE-2026-8398](https://nvd.nist.gov/vuln/detail/CVE-2026-8398)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-8398](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398)
6. [Help Net Security — Attackers compromised Daemon Tools software to deliver backdoors](https://www.helpnetsecurity.com/2026/05/06/daemon-tools-compromised-backdoors-supply-chain-attack/)

---
Source page: https://erroneo.us/security/briefs/daemon-tools-lite-cve-2026-8398-supply-chain-backdoor/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt