A widely used disk imaging application, Daemon Tools, has been compromised in a month-long supply-chain attack that saw malware pushed through official channels. The security firm Kaspersky identified the breach on April 8 and noted that versions 12.5.0.2421 to 12.5.0.2434 were affected.

The infected software collected data including MAC addresses, hostnames, DNS domain names, running processes, installed software, and system locales, before transmitting this information to an attacker-controlled server. The attack targeted thousands of machines across more than 100 countries, with about 12 receiving a follow-up payload indicative of selective targeting.

This incident is part of a broader trend of sophisticated supply-chain attacks, including the notorious poisoning of CCleaner and Solar Winds. Such attacks are particularly insidious because users are compromised when they simply install software updates through official channels, highlighting the difficulty in defense against such threats.

Kaspersky's analysis concludes that the attack was orchestrated with high sophistication, similar to previous incidents like 3CX. For organizations, it is now imperative to carefully scrutinize systems for any unusual activity post-April 8, as the timeframe between infection and detection can be alarmingly long.