- How the attack works: how a backdoor gets into your company
- Who is behind it: the Chinese hacker hypothesis
- Immediate impact on Italian SMEs with Windows machines
- What to do now: priority actions for the next 48 hours
- The work still ahead: supply chain security as a structural priority
- Outlook: what to expect in the coming months
Kaspersky has identified a large-scale malicious campaign. Hackers believed to be of Chinese origin allegedly planted a backdoor inside counterfeit versions of Daemon Tools, the popular Windows software for managing disk images. Researchers have already documented at least a dozen confirmed compromises and thousands of infection attempts.
Any organization that uses Daemon Tools on company Windows machines should therefore consider itself potentially exposed. Italian SMEs in particular, often without dedicated security staff, are a high-risk target. The immediate priority, then, is to verify where the installations in your company came from and isolate any suspicious systems.
At SHM Studio, we constantly monitor the digital threat landscape to help our SME clients manage cyber risk. In short: this incident confirms that the software supply chain, even for seemingly harmless tools, is now a primary attack vector. Acting quickly is essential.
How the attack works: how a backdoor gets into your company
On May 5, 2026, Kaspersky researchers published a technical analysis that immediately caught the attention of the cybersecurity community. According to TechCrunch, the attack vector is Daemon Tools, software widely used on Windows to manage disk images in ISO and similar formats.
Specifically, the attackers allegedly distributed modified versions of the program through unofficial channels. Users who downloaded and installed these versions unknowingly opened a remote access door into their systems. The damage is therefore not caused by a vulnerability in the original software, but by the installer being replaced with a compromised copy.
Kaspersky estimates thousands of infection attempts and at least twelve confirmed compromises. However, the real number could be significantly higher, given that many SMEs lack advanced detection tools.
Who is behind it: the Chinese hacker hypothesis
Kaspersky researchers attribute the operation to a threat group believed to be linked to China. Still, attribution in cybersecurity is always a complex exercise. The technical indicators, including the command-and-control infrastructure and the obfuscation techniques, are consistent with campaigns previously documented by other security vendors.
According to Gartner Cybersecurity Insights, software supply chain attacks are growing steadily. It's no surprise, then, that a popular program like Daemon Tools has become a strategic vector. Similar incidents have involved tools such as CCleaner and SolarWinds in the past.
What's more, the choice of Daemon Tools is no accident. The software is especially common in small and mid-sized businesses, which often lack strict policies on managing installations. The profile of potential victims matches that of Italian SMEs exactly.
Immediate impact on Italian SMEs with Windows machines
Italian small and medium-sized businesses make up a significant share of Windows users in Europe. In many cases, in-house IT teams are small or nonexistent. As a result, software is often managed informally, with downloads from unverified sources.
The real risk for an SME is therefore twofold. First, there's the risk of sensitive data being exfiltrated through the installed backdoor: credentials, customer data, financial information. Second, once an endpoint is compromised, the attacker can move laterally across the company network and reach critical systems.
At SHM Studio, we work every day with SMEs that handle B2B and retail customer data. We understand well how a single compromised endpoint can become the entry point for a far broader breach. A company's digital strategy cannot ignore a minimum level of cybersecurity.
What to do now: priority actions for the next 48 hours
Facing an active, documented threat, your response must be fast and methodical. Here are the priority actions every IT manager or SME owner should start right away.
- Installation inventory: check every company device for Daemon Tools. Compare the installed version and the executable file's hash against the official ones.
- Preventive isolation: isolate any machine with an installation of doubtful origin from the company network until the analysis is complete.
- Scan with updated tools: run a full scan with EDR or antivirus solutions updated to the latest definitions. Kaspersky has already released specific signatures for this threat.
- Download policy review: introduce or strengthen company policies on software installation, limiting downloads to official, verified channels only.
- Notify your DPO: if the compromised systems process personal data, assess whether you must notify the Italian data protection authority (Garante Privacy) within 72 hours, as required by the GDPR.
We also recommend checking the CISA Known Exploited Vulnerabilities Catalog for real-time updates on this and other related threats.
The work still ahead: supply chain security as a structural priority
This incident is not isolated. On the contrary, it fits an established trend in which attackers target the software distribution chain rather than the target systems directly. According to recent McKinsey research, organizations that invest in software supply chain controls significantly reduce their exposed attack surface.
Still, for many Italian SMEs, supply chain security remains an abstract concept. Day-to-day operational priorities leave little room for strategic security planning. Yet, as the Daemon Tools case shows, even a seemingly trivial utility can become a critical vector.
That's why the AI and automation consulting SHM Studio offers to SMEs always includes an assessment of overall digital risk. Building security into digitalization isn't an extra cost: it's a requirement for business continuity. Likewise, the choice of digital tools, from web systems to marketing platforms, must take security requirements into account from the design stage.
Outlook: what to expect in the coming months
The campaign documented by Kaspersky may not be over. New indicators of compromise and further victims are likely to emerge in the coming weeks. It's also reasonable to expect that other Windows utility programs, with large user bases and limited distribution controls, will be targeted with similar techniques.
In this scenario, Italian SMEs operating in B2B and retail need to speed up their shift toward more structured IT management. That doesn't necessarily mean building an in-house SOC. It means adopting basic digital hygiene practices: centralized update management, privileged access control, and regular staff training.
Finally, if you run digital campaigns, whether on Google Ads, on LinkedIn or through SEO, keep in mind that a compromised system can wipe out months of work. Analytics data, advertising platform credentials and company blog content are all exposed assets in the event of a breach. So cybersecurity isn't just a technical issue: it's part of digital marketing and of your online reputation. To learn more or request an assessment, you can contact the SHM Studio team. The strategic copywriting and digital presence of a business are worth only as much as the security of the systems that host them.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
