The PolySwarm Blog

Analyze suspicious files and URLs, at scale, millions of times per day. Get real-time threat intel from a crowdsourced network of security experts and antivirus companies competing to protect you.

DAEMON Tools Backdoor Enables Targeted Follow-On Malware Operations

May 11, 2026 3:03:25 PM / by The Hivemind posted in Threat Bulletin, Supply Chain Attack, PowerShell malware, Chinese threat actors, DAEMON Tools, QUIC RAT, Trojanized Installer, Software Supply Chain Security, Backdoor Malware

0 Comments

Verticals Targeted: Government, Scientific Research, Manufacturing, Retail, Education
Regions Targeted: Russia, Belarus, Thailand, Brazil, Turkey, Spain, Germany, France, Italy, China
Related Families: QUIC RAT

Executive Summary

A large-scale supply chain compromise involving the widely used DAEMON Tools software platform has exposed organizations and consumers to malicious payload deployment through digitally signed installers distributed from the vendor’s legitimate infrastructure. The attack, active since at least April 8, 2026, involved trojanized versions of DAEMON Tools containing embedded backdoors capable of downloading and executing additional malware. While thousands of infection attempts were observed globally, the operation appears selectively targeted, with advanced payloads deployed against a small subset of victims.

Read More

VoidLink: An Emerging Cloud-Focused Linux Malware Framework

Jan 20, 2026 1:03:14 PM / by The Hivemind posted in Threat Bulletin, C2 framework, Linux malware framework, cloud-native malware, Zig programming language, Linux rootkit, adaptive stealth, VoidLink malware, Chinese threat actors, container escape

0 Comments

Verticals Targeted: None confirmed
Regions Targeted: None confirmed
Related Families: None

Executive Summary

VoidLink represents an advanced, modular Linux malware framework developed with apparent Chinese affiliation, emphasizing cloud and container environments for stealthy, persistent access. Designed as a comprehensive post-exploitation tool with adaptive evasion and a plugin-based architecture, it remains in active development with no observed real-world deployments to date.

Read More

Subscribe to Email Updates

Lists by Topic

see all

Posts by Topic

See all

Recent Posts