Executive Summary
In early May 2026, a sophisticated supply chain attack was identified targeting the legitimate installers of DAEMON Tools. From April 8, 2026, versions 12.5.0.2421 through 12.5.0.2434 were trojanized with malicious code signed with valid digital certificates. The attack followed a tiered approach: thousands of users received an initial information collector for profiling, while a highly selective group of dozen organizations—including government, scientific, and manufacturing entities—received advanced persistent backdoors.
The intrusion involves multiple payloads, most notably the 'QUIC RAT,' a complex C++ implant using the WolfSSL library and supporting numerous communication protocols like HTTP/3 and QUIC. While artifacts within the code contain Chinese-language strings, no formal attribution has been made. The primary targets were located in Russia, Belarus, and Thailand, indicating a highly targeted cyberespionage or 'big game hunting' operation.