Threadlinqs IntelligenceStart free

Threat actorChinaTracked since 2026-10

Daxin operators

As of 2026-11-03, Daxin operators is a China-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning apt, malware. ATT&CK coverage spans 21 techniques across 10 tactics in 2 of 2 tracked threats. Most-observed techniques: T1014 (Rootkit), T1190 (Exploit Public-Facing Application), T1205 (Traffic Signaling).

Tracked threats
22 high
First seen
2026-10-29
Last seen
2026-11-03
ATT&CK techniques
21across 2 of 2 threats
Related CVEs
1Referenced by its activity
Attribution
ChinaNation or origin
Nation: China · 2 tracked threat(s) · Categories: APT, MALWARE

Activity timeline

Daxin operators appears in 2 tracked threats between and ; the busiest month was 2026-10 with 1 report.

ATT&CK techniques observed

21 techniques observed across 2 of 2 tracked threats · Command and Control (4), Stealth (formerly Defense Evasion) (4), Initial Access (3), Collection (2), Defense Impairment (2), Execution (2)
  • T1014 Rootkit — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 2 of 2 tracked threats
  • T1205 Traffic Signaling — Command and Controlobserved in 2 of 2 tracked threats
  • T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL — Persistenceobserved in 2 of 2 tracked threats
  • T1553.002 Code Signing — Defense Impairmentobserved in 2 of 2 tracked threats
  • T1036.005 Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1036.008 Masquerading: Masquerade File Type — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1056 Input Capture — Credential Accessobserved in 1 of 2 tracked threats
  • T1056.001 Keylogging — Collectionobserved in 1 of 2 tracked threats
  • T1057 Process Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 1 of 2 tracked threats
  • T1078.001 Valid Accounts: Default Accounts — Initial Accessobserved in 1 of 2 tracked threats
  • T1090.001 Proxy: Internal Proxy — Command and Controlobserved in 1 of 2 tracked threats
  • T1090.003 Multi-hop Proxy — Command and Controlobserved in 1 of 2 tracked threats
  • T1113 Screen Capture — Collectionobserved in 1 of 2 tracked threats

Tracked threats

Related CVEs

1 CVE referenced by tracked Daxin operators activity