CVE-2026-8398: DAEMON Tools Lite Supply-Chain Backdoor (KEV)

CVE-2026-8398 is a software supply-chain compromise in which attackers breached DAEMON Tools' (Disc Soft) build or distribution infrastructure and trojanized the free DAEMON Tools Lite Windows installer with a signed backdoor for about a month before discovery, and CISA added it to the Known Exploited Vulnerabilities catalog the same week Kaspersky and the vendor disclosed it.

CVE-2026-8398 affects DAEMON Tools Lite, a popular free Windows disc-image/virtual-drive utility published by Disc Soft (AVB Disc Soft). NVD's description states that a supply chain attack "compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026," and that "attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure" and trojanized three binaries — DTHelper.exe, DiscSoftBusServiceLite.exe and DTShellHlp.exe — which "were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection" (NVD).

Kaspersky's Securelist writeup gives the technical chain: the trojanized binaries dropped a .NET information-collector payload that gathered MAC addresses, hostnames, DNS domains, running processes, installed software and locale settings, then established persistence through a startup routine that called out to env-check.daemontools[.]cc; that command-and-control server could respond with PowerShell commands to fetch further payloads from IP 38.180.107[.]76. Selected higher-value targets received a minimalistic secondary backdoor (file download, shell command execution, in-memory shellcode) and, in roughly one organization observed by Kaspersky, a more sophisticated implant dubbed "QUIC RAT" with multi-protocol command-and-control over HTTP, UDP, TCP, WSS, QUIC, DNS and HTTP/3, plus process injection into notepad.exe and conhost.exe. Kaspersky recorded attempted infections across more than 100 countries and territories, concentrated in Russia, Brazil, Turkey, Spain, Germany, France, Italy and China, with the targeted secondary-payload victims mostly government, scientific, manufacturing and retail organizations in Russia, Belarus and Thailand; the compromise began around 2026-04-08 and went undetected for roughly a month before discovery in early May 2026 (Securelist: Popular DAEMON Tools software compromised).

NVD lists only a Secondary CVSS score from source [email protected]: CVSS v3.1 base score 9.8 (critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 base score 9.3. NVD's vulnerability status is "Analyzed," but no NVD Primary CVSS metric has been published, so that 9.8 figure is labelled not NVD-confirmed on this page; NVD's own CPE applicability statement scopes the affected product to the vendor-marketed version 12.5.1 of the Lite edition on Windows, matching Disc Soft's own version label even though Kaspersky describes the compromised internal build numbers as 12.5.0.2421 through 12.5.0.2434 (NVD).

Disc Soft's own incident statement says it was notified of the issue around 07:00 GMT on 2026-05-05 and released a clean version 12.6 roughly 12 hours later that "does not contain the suspected compromised files"; it confirms only the free DAEMON Tools Lite 12.5.1 was affected and that paid Ultra and Pro editions were not. The vendor tells affected users to uninstall 12.5.1, run a full system scan with trusted security software, and download the latest version (12.6) only from the official site (DAEMON Tools security incident notice).

CISA added CVE-2026-8398 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-05-27, with a required-action due date of 2026-05-30 — three days later — and records known ransomware-campaign use as "Unknown." Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.01456 (73.428th percentile) — modest, consistent with a time-boxed, already-remediated supply-chain incident rather than an ongoing mass-scan target (FIRST EPSS).

Anyone who installed or updated the free DAEMON Tools Lite between 2026-04-08 and 2026-05-05 should uninstall it, run a full anti-malware scan, check for the C2 indicators documented by Kaspersky (callouts to env-check.daemontools[.]cc and 38.180.107.76), rotate any credentials handled on the affected machine, and reinstall only version 12.6 or later from the official source.

• Attackers compromised Disc Soft's build/distribution infrastructure and trojanized DAEMON Tools Lite installer binaries (DTHelper.exe, DiscSoftBusServiceLite.exe, DTShellHlp.exe) signed with the legitimate code-signing certificate, distributed from daemon-tools.cc roughly 2026-04-08 to 2026-05-05. — NVD
• The implant collected system/network info, phoned home to env-check.daemontools[.]cc for PowerShell-delivered payloads from 38.180.107.76, and deployed a secondary backdoor plus a multi-protocol "QUIC RAT" against select targets in 100+ countries, concentrated in Russia, Brazil, Turkey, Spain, Germany, France, Italy and China. — Securelist: Popular DAEMON Tools software compromised
• NVD lists only a Secondary CVSS v3.1 score of 9.8 (critical) and CVSS v4.0 score of 9.3 from source [email protected]; no NVD Primary metric is published, so the score is not NVD-confirmed. NVD's CPE scope is version 12.5.1 of DAEMON Tools Lite on Windows. — NVD
• Disc Soft confirms only free DAEMON Tools Lite 12.5.1 was affected (Ultra/Pro unaffected), was notified around 07:00 GMT 2026-05-05, and released clean version 12.6 about 12 hours later; tells users to uninstall 12.5.1, scan for malware, and reinstall 12.6+ from the official site. — DAEMON Tools security incident notice
• Added to the CISA KEV catalog on 2026-05-27, required-action due date 2026-05-30, known ransomware campaign use recorded as Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
• EPSS score is 0.01456 (73.428th percentile) as of 2026-10-29. — FIRST EPSS