---
title: "Supply Chain Alert: DAEMON Tools Installers Compromised"
url: https://www.broadcom.com/support/security-center/protection-bulletin/supply-chain-alert-daemon-tools-installers-compromised
description: DAEMON Tools supply chain attack uses a multi-stage backdoor and "QUIC RAT" for global espionage.
---

# Supply Chain Alert: DAEMON Tools Installers Compromised

May 06, 2026

Security researchers at Kaspersky have uncovered a sophisticated supply chain attack targeting DAEMON Tools, where legitimate installers were trojanized with a multi-stage backdoor. Since April 2026, compromised binaries signed with valid certificates have deployed an initial information collector to thousands of global victims. For high-value targets, the attackers escalate to a "QUIC RAT"—a complex implant supporting diverse communication protocols. This malicious code, potentially linked to Chinese-speaking actors, allows for remote command execution and memory injection. Organizations are urged to audit systems for specific trojanized versions to mitigate ongoing espionage risks and potential data theft.

Symantec protects you from this threat, identified by the following:

**Adaptive-based**
- ACM.Icacls-Lnch!g1

**Behavior-based**
- SONAR.TCP!gen6

**Carbon Black-based**
- Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

**File-based**
- Trojan Horse
- Trojan.Dropper
- Trojan.Gen.MBT
- WS.Malware.1
- WS.Malware.2

**Machine Learning-based**
- Heur.AdvML.A!300
- Heur.AdvML.A!400
- Heur.AdvML.A!500
- Heur.AdvML.B
- Heur.AdvML.B!100
- Heur.AdvML.B!200

**Policy-based**  
Symantec Data Center Security (DCS) protects against CVE-2026-8398:
- Enforcing Least Privilege & Sandboxing (Zero-Trust Execution):  Under a standard DCS Windows Prevention Policy, interactive utilities and non-core applications are heavily sandboxed. Even if DTHelper.exe runs with local administrative privileges, DCS prevents it from spawning unapproved command shells, script interpreters, or launching secondary executable payloads.
- Hardening and Restricting OS Modifications:  DCS isolates the operating system's core. Any attempt by a non-system utility like DAEMON Tools to modify core OS files, inject code into other running processes, or edit protected registry paths is automatically blocked out-of-the-box.

**Web-based**
- Observed domains/IPs are covered under security categories in all WebPulse enabled products.