Kaspersky suspects Chinese hackers planted a backdoor into Daemon Tools in ‘widespread’ attack

mikho — Thu, 07 May 2026 07:25:26 +0000

Security researchers at Kaspersky say they have identified a malicious backdoor planted in the popular and long-running Windows disc imaging software, Daemon Tools.

The Russian cybersecurity company said on Tuesday that data collected from computers around the world running the Kaspersky antivirus software shows a “widespread” attack is under way, targeting thousands of Windows computers running Daemon Tools.

https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/

‘Frebniis’ Malware Hijacks Microsoft IIS Function to Deploy Backdoor

AuroraZero — Sun, 19 Feb 2023 18:09:36 +0000

This is interesting to me anyways.

it seems the malware injects code into a DLL that an IIS feature called Failed Request Event Buffering (FREB) uses when troubleshooting failed requests.

‘Frebniis’ Malware Hijacks Microsoft IIS Function to Deploy Backdoor

malware — LowEndSpirit

Kaspersky suspects Chinese hackers planted a backdoor into Daemon Tools in ‘widespread’ attack

‘Frebniis’ Malware Hijacks Microsoft IIS Function to Deploy Backdoor