Security researchers at Kaspersky have identified a malicious backdoor planted within the widely-used Windows disc imaging software, Daemon Tools. The attack, which targets specific computers in Russia, Belarus and Thailand, is part of a 'widespread' campaign that has infected thousands of machines worldwide.

The hackers, suspected to be linked to a Chinese-language speaking group based on malware analysis, have leveraged the backdoor to plant additional malware on a dozen targeted computers. These include retail, scientific and manufacturing sectors as well as government systems.

Kaspersky discovered this attack via its Kaspersky antivirus software, which detected the malicious activity on April 8th. The company has contacted Disc Soft, the developer of Daemon Tools, but no response or action was reported yet. The supply chain attack is still active, posing a continuing threat to users.

This incident follows a string of similar attacks targeting popular software developers in recent months. Hackers are increasingly using this approach to compromise large numbers of computers simultaneously via software updates. Similar incidents have been reported involving Notepad++ and CPUID’s tools.

Technical scrutiny revealed that the Windows installer from Daemon Tools’ website contains the backdoor, raising questions about the safety of other apps made by Disc Soft. In response, a Disc Soft representative stated they are investigating the situation but declined to comment further on specifics.