LONDON, May 6, 2026 — Kaspersky researchers on Tuesday disclosed that Daemon Tools, the widely deployed disk-image mounting utility developed by AVB, has been distributing backdoored installers from its official servers since at least 8 April 2026 — a supply-chain compromise that remained active at the time of publication and has already touched thousands of machines across more than 100 countries. The affected Windows builds, versions 12.5.0.2421 through 12.5.0.2434, carry the developer's legitimate digital certificate, making detection extraordinarily difficult for enterprise security teams and consumer antivirus products alike. According to Kaspersky, roughly 12 high-value targets in the retail, scientific, government, and manufacturing sectors received a second-stage payload, suggesting a highly selective espionage operation rather than a broad-brush criminal campaign. This analysis, informed by Business20Channel.tv's ongoing cybersecurity coverage and our earlier investigation into software supply-chain risks, examines the technical mechanics of the attack, its competitive and market context, and the implications for procurement, compliance, and national security stakeholders.

Executive Summary

• Daemon Tools versions 12.5.0.2421–12.5.0.2434, signed with AVB's official certificate, have been distributing malware since 8 April 2026.
• Kaspersky confirmed infections across more than 100 countries, with approximately 12 organisations receiving a targeted second-stage payload.
• The initial payload harvests MAC addresses, hostnames, DNS domain names, running processes, installed software, and system locale data before exfiltrating them to an attacker-controlled server.
• Only Windows versions of the application appear to be affected, based on Kaspersky's technical indicators.
• Neither Kaspersky nor AVB had responded to press inquiries at the time Kaspersky's advisory went live on 5 May 2026.

Key Developments

How the compromise works

The attack exploits the implicit trust that operating systems and endpoint-protection tools place in code-signed binaries. Because the infected Daemon Tools installers bear AVB's genuine digital certificate, standard allowlist-based and signature-based detection layers pass the software without challenge. Once installed, the malicious code modifies Daemon Tools executables so the backdoor runs automatically at boot time — a persistence mechanism that survives reboots and, in many corporate environments, routine patch cycles. Kaspersky's 5 May 2026 advisory noted that the first-stage implant conducts a detailed fingerprint of the host machine, collecting MAC addresses, hostnames, DNS domain names, a full inventory of running processes, a list of installed software, and system locale settings. These reconnaissance artefacts are then transmitted to a command-and-control server operated by the threat actor. The breadth of collection — touching network topology, software estate, and geolocation proxies in a single sweep — is consistent with an advanced persistent threat (APT) performing target triage before deploying costlier capabilities.

Selective second-stage deployment

Of the thousands of machines compromised worldwide, Kaspersky identified only about 12 that received a follow-on payload. Those 12 belong to organisations in four verticals: retail, scientific research, government, and manufacturing. This ratio — roughly 12 out of thousands — points to a disciplined operational model. The attackers appear to sift through first-stage telemetry before committing higher-risk tools to a tiny subset of high-value networks. The pattern is reminiscent of the approach documented in the Reuters reporting on the 2020 SolarWinds incident, where the Sunburst implant infected approximately 18,000 organisations but only a fraction received hands-on-keyboard intrusion. The Daemon Tools operation, while smaller in absolute numbers, follows the same operational logic, suggesting a state-aligned or state-tolerated actor with specific intelligence-collection requirements. Neither Kaspersky nor AVB had been reachable for comment as of 5 May 2026.

Market Context & Competitive Landscape

Daemon Tools in the disk-imaging market

Daemon Tools has occupied a durable niche since its initial release in 2000, competing principally with PowerISO, WinCDEmu, and Microsoft's native Windows 10/11 ISO-mounting capability introduced in 2012. According to download trackers, Daemon Tools has accumulated more than 300 million cumulative downloads over its 26-year lifespan, though exact active-user counts are not publicly disclosed by AVB. PowerISO, a commercial competitor priced at US $29.95 per licence, and WinCDEmu, an open-source alternative, have not reported similar supply-chain incidents to date. Microsoft's built-in mounting function, while limited in feature scope, carries the advantage of being distributed and signed through the Windows Update infrastructure — an environment that, despite its own 2024 driver-signing policy controversies reported by BleepingComputer, benefits from a substantially larger security-engineering investment.

How this compares to prior supply-chain attacks

The Daemon Tools compromise joins a growing catalogue of software supply-chain breaches. The SolarWinds Orion attack disclosed in December 2020 affected approximately 18,000 customers and prompted executive orders from the Biden administration. The 3CX VoIP compromise in March 2023, attributed by Mandiant to a North Korea–linked group, cascaded from an earlier supply-chain breach of Trading Technologies. The xz Utils backdoor discovered in March 2024 targeted open-source Linux compression libraries and was caught only weeks before reaching stable distributions. Each episode has reinforced the case for software bills of materials (SBOMs) and build-provenance attestation frameworks such as SLSA and Sigstore.

Industry Implications

Government and defence

Kaspersky confirmed that government organisations are among the roughly 12 entities that received the second-stage payload. For public-sector IT teams, the fact that the malware was signed with AVB's legitimate certificate undercuts a foundational assumption of endpoint-allowlisting policy. The US Cybersecurity and Infrastructure Security Agency (CISA) has spent three years promoting SBOM adoption since its May 2023 guidance; this incident will almost certainly intensify that campaign. In the EU, the Cyber Resilience Act (CRA), due to take effect in 2027, mandates that software vendors provide machine-readable SBOMs and implement vulnerability-handling processes — provisions that, had they been in force, could have shortened the detection window for the Daemon Tools compromise.

Retail and manufacturing

Two of the four named verticals — retail and manufacturing — are sectors that frequently rely on legacy Windows utilities for operational-technology (OT) environments. Daemon Tools, originally designed for CD/DVD emulation, retains a foothold in environments where physical media workflows persist: factory-floor imaging, point-of-sale system provisioning, and archival media access. The IBM Cost of a Data Breach Report 2025 pegged the average breach cost for manufacturing at US $5.56 million, up 12 per cent year-on-year. For retailers, the figure stood at US $3.91 million. A supply-chain vector that bypasses certificate checks and lands a persistent implant inside these networks represents a material financial risk, not merely an IT headache.

Scientific research

Kaspersky's inclusion of scientific organisations in the second-stage target list raises intellectual-property concerns. Research institutions routinely handle pre-publication data, proprietary algorithms, and grant-funded datasets whose exfiltration could benefit state-sponsored competitors. The Business20Channel.tv AI section has previously reported on the intersection of espionage and AI-research theft — a pattern that this incident may extend into the physical-sciences domain.

Business20Channel.tv Analysis

The certificate-trust paradox

The most consequential detail in Kaspersky's advisory is not the malware itself — first-stage reconnaissance implants are operationally routine. The critical detail is that the infected binaries carry AVB's genuine digital certificate. Code signing was designed to solve a specific problem: allowing end-users and automated systems to verify that software originates from the claimed publisher and has not been tampered with in transit. When an attacker compromises the build pipeline or signing infrastructure, the entire trust model collapses. This is not a theoretical concern; it is the same failure mode that enabled the SolarWinds and 3CX incidents. Yet, as of 2026, the industry has made only incremental progress toward build-provenance frameworks that would detect such tampering independently of the publisher's own key material. The Supply-chain Levels for Software Artefacts (SLSA) framework, backed by Google, defines four maturity levels; most commercial Windows desktop software, including Daemon Tools, has not publicly attested to any SLSA level. Until provenance attestation becomes a procurement requirement — not a voluntary badge — supply-chain attacks that weaponise legitimate certificates will recur.

The triage model and what it reveals

The ratio of approximately 12 second-stage targets out of thousands of first-stage infections is analytically significant. It implies an operator with defined intelligence requirements, not a financially motivated criminal group seeking maximum monetisation. Financially motivated actors — ransomware affiliates, access brokers — typically exploit as many footholds as possible within days. The Daemon Tools operator waited, sifted, and selected. This patience is a hallmark of state-aligned threat groups documented by Mandiant, Microsoft Threat Intelligence, and Kaspersky's own APT-tracking division. Without formal attribution, speculation on the responsible state is unwise. What we can say with confidence is that the operational model fits the template of strategic cyber-espionage rather than cybercrime. Enterprises that discover they are running affected Daemon Tools versions should therefore treat remediation as an intelligence-driven incident-response exercise, not merely a patch-and-move-on task.

Procurement and vendor-risk implications

For CISOs and procurement teams, this incident reinforces a lesson that the Business20Channel.tv enterprise cybersecurity desk has documented repeatedly: third-party software risk cannot be managed solely through contractual warranties or annual penetration-test reports. AVB is a small developer by enterprise-software standards. Its security-engineering budget is unlikely to rival that of Microsoft, Adobe, or SAP. Yet its product runs with elevated privileges on Windows machines that may sit inside otherwise well-defended networks. The asymmetry between the software's attack surface and the vendor's security investment is the structural vulnerability. Organisations should audit their software inventories for similar asymmetries: widely deployed utilities from small vendors that enjoy persistent, privileged access but face limited security scrutiny.

Why This Matters for Industry Stakeholders

First, any organisation running Daemon Tools versions 12.5.0.2421 through 12.5.0.2434 on Windows should isolate affected machines immediately and conduct forensic triage. Kaspersky's indicators of compromise, published in its 5 May 2026 advisory, should be integrated into SIEM and EDR rulesets without delay. Second, IT procurement teams should request SBOM documentation and build-provenance attestations from all software vendors whose products run with system-level privileges. Third, security operations centres should not rely solely on code-signing validation as a trust signal; behavioural detection — monitoring for anomalous network connections at boot time, unexpected process-tree relationships, and bulk telemetry exfiltration — is essential to catching supply-chain compromises that pass signature checks. Fourth, boards and risk committees should treat this incident as a case study when reviewing third-party cyber-risk frameworks, particularly in sectors — retail, manufacturing, government, scientific research — that Kaspersky identified as targets.

Forward Outlook

Three developments bear watching over the next 90 days. First, attribution: Kaspersky, Microsoft Threat Intelligence, and government agencies including CISA and the UK National Cyber Security Centre (NCSC) may publish coordinated attribution findings if intelligence-community consensus forms. Second, regulatory response: the Daemon Tools incident is precisely the kind of event that EU policymakers designed the Cyber Resilience Act to address; expect calls to accelerate the CRA's 2027 enforcement timeline. Third, market behaviour: enterprise buyers may increasingly favour operating-system-native functionality over third-party utilities for low-complexity tasks such as ISO mounting, shrinking the addressable market for niche tools. AVB's own commercial viability will depend on how transparently and rapidly it discloses the root cause, remediates the build infrastructure, and submits to independent audit. The company's silence as of 5 May 2026 is not encouraging. For the broader software industry, this episode is another data point in an unmistakable trend: supply-chain attacks are becoming the preferred initial-access vector for sophisticated threat actors, and the defensive toolbox remains inadequate. Until Business20Channel.tv and the wider security community can report that build-provenance attestation is as routine as TLS certificates, the question is not whether the next supply-chain compromise will occur — but which vendor will be next.

Key Takeaways

• Daemon Tools versions 12.5.0.2421–12.5.0.2434 have been distributing signed, backdoored Windows installers from AVB's servers since 8 April 2026, affecting thousands of machines in over 100 countries.
• Approximately 12 organisations in government, retail, scientific, and manufacturing verticals received a second-stage payload — a pattern consistent with state-aligned espionage, not cybercrime.
• The use of AVB's genuine digital certificate undermines code-signing trust and highlights the industry's slow adoption of build-provenance frameworks such as SLSA and Sigstore.
• Enterprises should audit for similar risk asymmetries: widely deployed, privileged utilities from vendors with limited security-engineering resources.
• Regulatory momentum, particularly the EU Cyber Resilience Act, is likely to accelerate in response to this and similar incidents.

References & Bibliography

[1] Goodin, D. (2026, May 5). Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack. Ars Technica.
[2] Kaspersky. (2026, May 5). Daemon Tools supply-chain compromise advisory. Kaspersky.
[3] CISA. (2023). Software Bill of Materials (SBOM). CISA.
[4] European Commission. (2025). Cyber Resilience Act. European Commission.
[5] Mandiant. (2023). 3CX Supply-Chain Attack Analysis. Mandiant.
[6] Microsoft Threat Intelligence. (2026). Threat actor tracking blog. Microsoft.
[7] SLSA. (2024). Supply-chain Levels for Software Artefacts. SLSA.
[8] Sigstore. (2024). Software signing and verification. Sigstore.
[9] IBM. (2025). Cost of a Data Breach Report 2025. IBM.
[10] Reuters. (2026). Technology section. Reuters.
[11] Greenberg, A. (2024, March 29). The xz Utils backdoor. Wired.
[12] The Verge. (2024, March 29). xz Utils backdoor. The Verge.
[13] BleepingComputer. (2024). Driver-signing policy coverage. BleepingComputer.
[14] Sanger, D. et al. (2021, January 2). Russian hacking. The New York Times.
[15] NCSC. (2026). UK National Cyber Security Centre. NCSC.
[16] PowerISO. (2026). Product page. PowerISO.
[17] WinCDEmu. (2026). Project page. WinCDEmu / Sysprogs.
[18] Business20Channel.tv. (2026). AI and cybersecurity coverage. Business20Channel.tv.
[19] Business20Channel.tv. (2026). Supply-chain security risks. Business20Channel.tv.
[20] Business20Channel.tv. (2026). Enterprise cybersecurity procurement. Business20Channel.tv.