Daxin Returns: China-Linked Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Backdoor — Threadlinqs Intelligence
As of 2026-07-15, Daxin Returns: China-Linked Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Backdoor is a critical-severity malware threat attributed to China-linked espionage group (Daxin (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1362 · Severity: CRITICAL · Status: ACTIVE · Category: MALWARE
Attribution: China-linked espionage group (Daxin · China · ESPIONAGE
Symantec's Threat Hunter Team discovered the kernel-mode Daxin rootkit (Backdoor.Daxin, srt64.sys) co-deployed with a previously unknown backdoor, Stupig (a.dll/kbdus1.dll), on a Taiwan-based
In May 2026, host telemetry at a Taiwan-based subsidiary of a multinational high-tech manufacturer revealed the presence of the kernel-mode rootkit Backdoor.Daxin, first publicly documented by Symantec/Broadcom and jointly detailed by CISA and the FBI in March 2022 as one of the most sophisticated pieces of China-linked espionage tooling ever analyzed. Daxin ships as a Windows kernel driver (observed here as srt64.sys, dropped to %SystemRoot%\System32\drivers) that hooks the Windows NDIS layer, registering a fake NDIS protocol identified internally as "NDISXRPT." Rather than beaconing outbound, Daxin passively monitors legitimate inbound TCP traffic for hardcoded trigger patterns (an HTTP POST containing the string "756981520337", or raw byte sequences 0x10 0x99 0x10 / 0x10 0x99 0x11), hijacks the matched connection by spoofing a TCP RST to the original destination and an ACK to the original source, and then performs a custom bidirectional key exchange to open an encrypted C2 channel over the stolen connection. The driver forges its own IPv4/TCP/UDP packets, bypassing the native Windows TCP/IP stack entirely, and exposes a virtual \\.\Tcp4 device for registering additional service handlers. This design lets operators relay a single command across a chain of previously compromised nodes (each entry specifying IP, port, and key-exchange credentials) to reach systems with no direct internet connectivity — a capability CISA highlighted as enabling access to "secured devices not connected directly to the internet." Daxin can read/write arbitrary files, spawn EXE payloads with redirected stdin/stdout for interactive shell access, and inject DLL payloads into svchost.exe.
Alongside Daxin, the Threat Hunter Team identified a second, previously undocumented implant, Backdoor.Stupig, first seen as a.dll and later renamed kbdus1.dll. Stupig persists by registering itself as a Windows keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at every system startup via an undocumented registry loading path — functionally similar to Winlogon Helper DLL persistence (T1547.004) but not using the documented registry values associated with that technique. The DLL returns a valid KBDTABLES structure to preserve normal keyboard functionality while it silently monitors the logon screen for any username beginning with the string "stupig"; text following that trigger is executed as SYSTEM on the secure desktop (Winsta0\Winlogon) before authentication completes, generating no audit anomaly beyond a routine failed-logon event for an unusual username. Stupig additionally installs inline API hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA — implemented via VirtualProtect, ZwAllocateVirtualMemory, and memcpy to patch the functions in memory — to intercept credentials during the logon and credential-unprotection flows. A LoadLibraryA("msyun.dll") call inside the sample references a companion payload that was not recovered from the compromised host, indicating additional undiscovered tooling.
Investigators assess likely initial access through an outdated Digiwin single sign-on portal exposed by the victim, running Java Development Kit versions 1.5 and 1.6 (installed 2009-2011), both of which reached end-of-life years before the intrusion (JDK 1.5 in 2009, JDK 1.6 in 2013) and were never patched or replaced. No specific CVE has been published for the exploited weakness; the exposure is attributed to prolonged use of unsupported, unpatched middleware rather than a single disclosed vulnerability.
Symantec attributes both tools to the same China-linked espionage actor based on compile timestamps only weeks apart (January and February 2013), consistent low-level development practices, co-deployment on the same host, and complementary operational roles (Daxin for network-level C2 and lateral relay, Stupig for local credential theft and pre-auth code execution), though no direct code-level relationship between the two families was es
Weaknesses (CWE)
CWE-1104, CWE-937, CWE-306
Target sectors: manufacturing, high tech, government administration, telecoms, transport
Target regions: taiwan, East Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1587, T1190, T1133, T1059, T1106, T1547, T1547, T1543, T1547, T1055