Kaspersky’s Global Research and Analysis Team (GReAT) discovered an active supply chain attack targeting the official website of Daemon Tools, a widely used virtual drive emulation software.

The compromised installer delivers malicious software alongside the legitimate application, granting threat actors the ability to execute arbitrary commands and remotely control infected devices.

During a recent telemetry study, researchers identified that threat actors have actively distributed the modified software directly through the vendor’s primary domain since April 8, 2026, successfully concealing the malware with a valid developer digital certificate.

The malicious injection affects Daemon Tools version 12.5.0.2421 up through the current release. Kaspersky has notified AVB Disc Soft, the developer of Daemon Tools, so that remediation actions can be taken.

Because disk emulation software requires low-level system access to function properly, users routinely grant the application elevated administrative privileges during installation. This mechanism allows the embedded malware to secure a deep foothold within the host operating system, severely compromising device integrity.

Specifically, attackers tampered with legitimate application binaries to execute malicious code at process startup and leveraged a legitimate Windows service to maintain persistence on the host.

Kaspersky telemetry indicates a widespread, global distribution of the compromised updates across more than 100 countries and territories. The majority of victims are located in Russia, Brazil, Türkiye, Spain, Germany, France, Italy, and China.

The analysis shows that 10% of the affected systems belong to businesses and organisations. While Daemon Tools is heavily adopted by consumers, its presence in corporate environments exposes enterprise networks to severe downstream risks.

On a small subset of just over ten machines — belonging to organisations in the retail, scientific, government, and manufacturing sectors — Kaspersky GReAT observed attackers manually deploying additional payloads, including a shellcode injector and previously unknown Remote Access Trojans (RATs).

The narrow industry profile of these victims, combined with typos and inconsistencies in the executed commands, indicates that the follow-on activity is conducted hands-on against specifically chosen targets.

While researchers identified Chinese-language artifacts within the malicious implants, the campaign is not currently attributed to any known threat actor.

“A compromise of this nature bypasses traditional perimeter defences because users implicitly trust digitally signed software downloaded directly from an official vendor,” said Georgy Kucherin, senior security researcher at Kaspersky GReAT. “Because of that, the Daemon Tools attack has gone unnoticed for about a month.

This period of time, in turn, indicates that the threat actor behind this attack is sophisticated and has advanced offensive capabilities. Given the high complexity of the compromise, it is thus of paramount importance for organisations to isolate machines having Daemon Tools software installed, as well as to conduct security sweeps to prevent further spreading of malicious activities inside corporate networks.”

Kaspersky actively detects and blocks the execution of the compromised installers. Researchers advise organisations to audit their networks for the presence of Daemon Tools Lite, isolate affected endpoints, and monitor for unauthorised command execution or lateral movement. Individual users should promptly uninstall the compromised application and run a thorough system scan to clear any persistent threats.

In March 2026, a Kaspersky study found supply chain attacks were the most common cyberthreat businesses faced over the prior 12 months, yet only 9% of organisations ranked them as a top concern.

Kled AI, US-based developer, has announced the removal of its application from the Nigerian app store, alongside an IP restriction affecting the region, citing what it described as an “unmanageable level of fraudulent activity” on the platform.

Kled is a data marketplace that rewards users for uploading photos, videos, and other multimodal content.

Avi Patel, 22-year-old founder, in his X handle, said the decision followed months of internal review, during which the startup found that a large share of uploads from Nigeria, including images, documents, and videos meant for AI training, were fake, duplicated, or generated by artificial intelligence.

Kled operates what it describes as an opt-in data marketplace, where users voluntarily upload personal content in exchange for payment, with the material later sold to AI labs for training models.

The startup said it has paid hundreds of thousands of users globally and processed over one billion data assets within four months of launch.

However, Patel said Nigeria stood out negatively.

According to him, the company reviewed a sample of 10 million uploads from the country and found that only a small fraction met quality standards required for AI training.

He added that the problem escalated when the platform was flooded with manipulated identity documents, including fake passports, during its verification process.

“As a startup, we cannot absorb the cost of filtering that level of bad data,” Patel said, noting that the company has now removed the app from Nigeria’s Apple App Store and imposed an IP ban on the region while it strengthens its fraud detection systems.

“On top of all of this, every time we make a post there is someone asking us to bring the region back within seconds. We hear you, but it’s gotten out of hand,” he added.

Despite the suspension, the company maintained that the move is temporary and not permanent.

“We’ve made this decision with great care. We love everyone who has genuinely supported Kled from Nigeria, and we hope to return when the time is right,” the statement concluded.

The decision has triggered backlash among Nigerian users, many of whom accuse the company of stereotyping and unfairly targeting the country.

Patel, however, insists the move is purely business-driven and not linked to race or nationality, stressing that Kled remains available in other African markets.

.

Although the main initial vectors in 2025 remain similar to 2024, their combined share has grown to over 80%. Public-facing applications account for 43.7%, while trusted relationships have increased from 12.7% to 15.5%.

Valid accounts make up 25.4%. These insights are from the recent Global Report by Kaspersky Security Services.

The ‘Anatomy of a Cyber World’ is an in-depth global report based on incident data gathered in 2025 from Kaspersky Managed Detection and Response, Kaspersky Incident Response, Kaspersky Compromise Assessment and Kaspersky SOC Consulting.

It highlights the most common attacker tactics, techniques and tools, as well as the peculiarities of detected incidents and their distribution across regions and industries.

According to data derived from Kaspersky Incident Response, the top three initial attack vectors have remained relatively stable over the past seven years and have not changed significantly. Valid accounts and exploits in public-facing applications consistently represent the most common entry points.

The third position has periodically shifted: malicious emails, once a common initial vector, were replaced by trusted relationships, which first appeared in 2021 and entered the TOP-3 in 2023. By 2025, the distribution of main vectors looked as follows:

These attack vectors are often interconnected within the same chain, for example, organisations compromised through trusted relationships are frequently first breached via exploits in public-facing applications. Recent cases reveal attackers targeting service providers or IT integrators to then access their clients.

This problem is compounded by many small service providers lacking dedicated cybersecurity expertise and resources. As they manage accounting software or websites, breaches in these companies can lead to the compromise of their clients’ systems through exploited remote access.

When examining the investigated attacks in terms of duration and impact, the data shows that the majority (50.9%) of them were rapid in nature, typically lasting less than a day and most often resulting in file encryption.

A significant portion (33%) were long-lasting, with an average duration of 108 hours, during which attackers not only encrypted files but also installed persistence mechanisms, compromised Active Directory and caused data leakage.

The remaining 16.1% exhibited a hybrid pattern: they initially appeared as rapid attacks but involved a considerable delay between the initial breach and subsequent malicious activities, extending their overall duration to nearly 19 days.

“Given that attackers are increasingly orchestrating coordinated, multi-stage attacks, organisations cannot afford to rely on a reactive, “firefighting” approach. To counter this, a proactive security posture is essential, one that embeds real-time threat monitoring and continuous detection into everyday operations.

This enables defenders to respond swiftly to adversary activity before it escalates. Key measures for protecting digital assets against both rapid intrusions and long-term compromises include: timely patching, enforcement of multi-factor authentication and strict control of third-party access,” comments Konstantin Sapronov, Head of Global Emergency Response Team at Kaspersky.