# Daxin operators

> As of 2026-11-03, Daxin operators is a China-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning apt, malware. ATT&CK coverage spans 21 techniques across 10 tactics in 2 of 2 tracked threats. Most-observed techniques: T1014 (Rootkit), T1190 (Exploit Public-Facing Application), T1205 (Traffic Signaling).

- **Nation:** China
- **Tracked threats:** 2
- **Categories:** APT, MALWARE
- **As of:** 2026-11-03

## ATT&CK techniques observed

21 techniques observed across 2 of 2 tracked threats. Tactics: Command and Control (4), Stealth (formerly Defense Evasion) (4), Initial Access (3), Collection (2), Defense Impairment (2), Execution (2).

- [T1014](https://intel.threadlinqs.com/technique/T1014) Rootkit — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 2 of 2 tracked threats
- [T1205](https://intel.threadlinqs.com/technique/T1205) Traffic Signaling — Command and Control — observed in 2 of 2 tracked threats
- [T1547.004](https://intel.threadlinqs.com/technique/T1547.004) Boot or Logon Autostart Execution: Winlogon Helper DLL — Persistence — observed in 2 of 2 tracked threats
- [T1553.002](https://intel.threadlinqs.com/technique/T1553.002) Code Signing — Defense Impairment — observed in 2 of 2 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1036.008](https://intel.threadlinqs.com/technique/T1036.008) Masquerading: Masquerade File Type — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1056](https://intel.threadlinqs.com/technique/T1056) Input Capture — Credential Access — observed in 1 of 2 tracked threats
- [T1056.001](https://intel.threadlinqs.com/technique/T1056.001) Keylogging — Collection — observed in 1 of 2 tracked threats
- [T1057](https://intel.threadlinqs.com/technique/T1057) Process Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 1 of 2 tracked threats
- [T1078.001](https://intel.threadlinqs.com/technique/T1078.001) Valid Accounts: Default Accounts — Initial Access — observed in 1 of 2 tracked threats
- [T1090.001](https://intel.threadlinqs.com/technique/T1090.001) Proxy: Internal Proxy — Command and Control — observed in 1 of 2 tracked threats
- [T1090.003](https://intel.threadlinqs.com/technique/T1090.003) Multi-hop Proxy — Command and Control — observed in 1 of 2 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 1 of 2 tracked threats

## Tracked threats

- [CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla, Daxin/Stupig, GoldenEyeDog DigiCert compromise, CVE-2026-40639](https://intel.threadlinqs.com/threat/TL-2026-5143) — HIGH
- [Daxin Returns: China-linked Backdoor.Daxin kernel rootkit and new Backdoor.Stupig (keyboard-layout DLL in winlogon.exe) found in Taiwan](https://intel.threadlinqs.com/threat/TL-2026-4700) — HIGH

## Related CVEs

1 CVE referenced by tracked Daxin operators activity.

- [CVE-2026-40639](https://intel.threadlinqs.com/cve/CVE-2026-40639)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Daxin%20operators