# Daxin Returns: China-Linked Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Backdoor

> Symantec's Threat Hunter Team discovered the kernel-mode Daxin rootkit (Backdoor.Daxin, srt64.sys) co-deployed with a previously unknown backdoor, Stupig (a.dll/kbdus1.dll), on a Taiwan-based subsidiary of a multinational high-tech manufacturer. Both samples carry early-2013 compile timestamps, indicating up to 13 years of undetected dwell time; likely initial access was an outdated Digiwin single sign-on portal running end-of-life JDK 1.5/1.6.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-09-08T13:49:08.837Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1362
- **ID:** TL-2026-1362
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In May 2026, host telemetry at a Taiwan-based subsidiary of a multinational high-tech manufacturer revealed the presence of the kernel-mode rootkit Backdoor.Daxin, first publicly documented by Symantec/Broadcom and jointly detailed by CISA and the FBI in March 2022 as one of the most sophisticated pieces of China-linked espionage tooling ever analyzed. Daxin ships as a Windows kernel driver (observed here as srt64.sys, dropped to %SystemRoot%\System32\drivers) that hooks the Windows NDIS layer, registering a fake NDIS protocol identified internally as "NDISXRPT." Rather than beaconing outbound, Daxin passively monitors legitimate inbound TCP traffic for hardcoded trigger patterns (an HTTP POST containing the string "756981520337", or raw byte sequences 0x10 0x99 0x10 / 0x10 0x99 0x11), hijacks the matched connection by spoofing a TCP RST to the original destination and an ACK to the original source, and then performs a custom bidirectional key exchange to open an encrypted C2 channel over the stolen connection. The driver forges its own IPv4/TCP/UDP packets, bypassing the native Windows TCP/IP stack entirely, and exposes a virtual \\.\Tcp4 device for registering additional service handlers. This design lets operators relay a single command across a chain of previously compromised nodes (each entry specifying IP, port, and key-exchange credentials) to reach systems with no direct internet connectivity — a capability CISA highlighted as enabling access to "secured devices not connected directly to the internet." Daxin can read/write arbitrary files, spawn EXE payloads with redirected stdin/stdout for interactive shell access, and inject DLL payloads into svchost.exe.

Alongside Daxin, the Threat Hunter Team identified a second, previously undocumented implant, Backdoor.Stupig, first seen as a.dll and later renamed kbdus1.dll. Stupig persists by registering itself as a Windows keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at every system startup via an undocumented registry loading path — functionally similar to Winlogon Helper DLL persistence (T1547.004) but not using the documented registry values associated with that technique. The DLL returns a valid KBDTABLES structure to preserve normal keyboard functionality while it silently monitors the logon screen for any username beginning with the string "stupig"; text following that trigger is executed as SYSTEM on the secure desktop (Winsta0\Winlogon) before authentication completes, generating no audit anomaly beyond a routine failed-logon event for an unusual username. Stupig additionally installs inline API hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA — implemented via VirtualProtect, ZwAllocateVirtualMemory, and memcpy to patch the functions in memory — to intercept credentials during the logon and credential-unprotection flows. A LoadLibraryA("msyun.dll") call inside the sample references a companion payload that was not recovered from the compromised host, indicating additional undiscovered tooling.

Investigators assess likely initial access through an outdated Digiwin single sign-on portal exposed by the victim, running Java Development Kit versions 1.5 and 1.6 (installed 2009-2011), both of which reached end-of-life years before the intrusion (JDK 1.5 in 2009, JDK 1.6 in 2013) and were never patched or replaced. No specific CVE has been published for the exploited weakness; the exposure is attributed to prolonged use of unsupported, unpatched middleware rather than a single disclosed vulnerability.

Symantec attributes both tools to the same China-linked espionage actor based on compile timestamps only weeks apart (January and February 2013), consistent low-level development practices, co-deployment on the same host, and complementary operational roles (Daxin for network-level C2 and lateral relay, Stupig for local credential theft and pre-auth code execution), though no direct code-level relationship between the two families was established. The actor has a documented history of long-running espionage operations against governments, telecommunications, transportation, and manufacturing organizations of strategic interest to China, with prior confirmed Daxin activity as recently as November 2021 against two other organizations. The 13-year gap between the 2013 compile timestamps and 2026 detection is consistent with this actor's pattern of extremely long-term, low-noise persistence inside hardened, high-value targets.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1055 Process Injection
- T1014 Rootkit
- T1553 Subvert Trust Controls
- T1205 Traffic Signaling
- T1055 Process Injection
- T1556 Modify Authentication Process
- T1003 OS Credential Dumping
- T1056 Input Capture
- T1082 System Information Discovery
- T1570 Lateral Tool Transfer
- T1021 Remote Services
- T1005 Data from Local System
- T1090 Proxy
- T1573 Encrypted Channel
- T1071 Application Layer Protocol
- T1205 Traffic Signaling
- T1041 Exfiltration Over C2 Channel
- T1036 Masquerading
- T1562 Impair Defenses
- T1569 Service Execution
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer

## Sources

- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor](https://www.security.com/threat-intelligence/daxin-returns-stupig)
- [Daxin Backdoor: In-Depth Analysis, Part One](https://www.security.com/threat-intelligence/daxin-malware-espionage-analysis)
- [CISA and FBI Release Advisory on Daxin Backdoor Used by People's Republic of China](https://www.cisa.gov/news-events/alerts/2022/03/01/cisa-and-fbi-release-advisory-daxin-backdoor-used-peoples-republic-china)
- [China-linked Daxin Malware Targeted Multiple Governments in Espionage Attacks](https://thehackernews.com/2022/03/china-linked-daxin-malware-targeted.html)
- [China-Linked APT Actors Deploying Stealthy Daxin Malware](https://www.bankinfosecurity.com/china-linked-apt-actors-deploying-stealthy-daxin-malware-a-18637)
- ['Most advanced' China-linked backdoor ever, Daxin, raises alarms for cyber-espionage investigators](https://cyberscoop.com/daxin-china-linked-symantec-cyber-espionage/)
- [Daxin Espionage Backdoor Ups the Ante on Chinese Malware](https://threatpost.com/daxin-espionage-backdoor-chinese-malware/178706/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1362