“march 27, roughly a week before the supply chain attack began. in response to the get requests, the command - and - control ( c2 ) server can return a shell command to be executed via the cmd. exe process. security researchers from securelist observed attackers using powershell c…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.002Compromise Software Supply Chain
89%
“hackers abuse daemon tools distribution channel to deliver malicious payloads a sophisticated supply - chain attack has compromised the official distribution channel for daemon tools, delivering multi - stage malware to users worldwide. since april 8, 2026, threat actors have dis…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1071.001Web Protocols
86%
“command - and - control servers to execute arbitrary shell commands. manual misspellings found in the deployment scripts ( such as typing “ chiper ” instead of “ cipher ” ) strongly indicate live, hands - on - keyboard activity by the hackers. - quic rat : the most advanced stage…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1055.001Dynamic-link Library Injection
78%
“command - and - control servers to execute arbitrary shell commands. manual misspellings found in the deployment scripts ( such as typing “ chiper ” instead of “ cipher ” ) strongly indicate live, hands - on - keyboard activity by the hackers. - quic rat : the most advanced stage…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1071Application Layer Protocol
57%
“command - and - control servers to execute arbitrary shell commands. manual misspellings found in the deployment scripts ( such as typing “ chiper ” instead of “ cipher ” ) strongly indicate live, hands - on - keyboard activity by the hackers. - quic rat : the most advanced stage…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1195.002Compromise Software Supply Chain
56%
“tools deep forensic analysis revealed that, for daemon tools versions 12. 5. 0. 2421 to 12. 5. 0. 2434, the attackers successfully compromised three specific binaries within the software installations. these files are dthelper. exe, discsoftbusservicelite. exe, and dtshellhlp. ex…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1072Software Deployment Tools
40%
“hackers abuse daemon tools distribution channel to deliver malicious payloads a sophisticated supply - chain attack has compromised the official distribution channel for daemon tools, delivering multi - stage malware to users worldwide. since april 8, 2026, threat actors have dis…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1204.002Malicious File
36%
“command - and - control servers to execute arbitrary shell commands. manual misspellings found in the deployment scripts ( such as typing “ chiper ” instead of “ cipher ” ) strongly indicate live, hands - on - keyboard activity by the hackers. - quic rat : the most advanced stage…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
A sophisticated supply-chain attack has compromised the official distribution channel for DAEMON Tools, delivering multi-stage malware to users worldwide. Since April 8, 2026, threat actors have distributed trojanized installers signed with legitimate digital certificates to conduct highly targeted cyberespionage operations. Attackers successfully breached the development pipeline of AVB Disc Soft, the creators of the widely […]