Backdoor.Stupig — Windows Login-Screen Keyboard-Layout Provider Backdoor Grants SYSTEM Access, Deployed Alongside Resurfaced Daxin
Backdoor.Stupig (TL-2026-1400), also tracked as Daxin Returns Campaign, is a high-severity malware campaign, first published 2026-07-16. It is attributed to Stupig intrusion set (China) with medium confidence, affects Microsoft Windows (keyboard-layout provider / winlogon.exe subsystem), maps to 15 MITRE ATT&CK techniques (T1014, T1021, T1036), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1400
- Threat ID
- TL-2026-1400
- Also known as
- Daxin Returns Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution
- Stupig intrusion set
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- technology, manufacturing, government administration, telecoms, transport
- Target regions
- taiwan, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Backdoor.Stupig
Malware and tooling: Backdoor.Daxin, Backdoor.Stupig, Backdoor.Zala
Symantec's Threat Hunter Team discovered Backdoor.Stupig, a novel Windows implant that registers as a malicious keyboard-layout provider DLL loaded into winlogon.exe at startup; typing a username beginning with "stupig" at the Windows logon screen spawns a SYSTEM-level command prompt on the secure Winlogon desktop, with any trailing text executed as a command, all before authentication and without generating a logon audit event. Stupig was found co-deployed on a compromised Taiwan-based subsidiary of a multinational high-tech manufacturer alongside Backdoor.Daxin, the sophisticated China-linked kernel-driver backdoor first publicly exposed in 2022, with both samples carrying compile timestamps from early 2013 — suggesting the intrusion went undetected for roughly 13 years. Initial access is believed to have involved an outdated Digiwin single sign-on portal running Java Development Kit builds from 2009-2011 (JDK 1.5/1.6), both long past end of life.
How Backdoor.Stupig works
In May 2026, Symantec's Threat Hunter Team identified telemetry from a previously unknown backdoor — Backdoor.Stupig — running on a compromised host belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer. Stupig masquerades as a legitimate Windows keyboard-layout component. By registering itself through the OS's keyboard-layout provider extensibility mechanism, Windows loads the malicious DLL into winlogon.exe at system startup, before any user authenticates. The DLL passes through normal keyboard data to avoid detection while silently monitoring the logon screen's username field. If an operator types a username beginning with the prefix "stupig," the malware launches a SYSTEM-privileged command prompt directly on the secure Winlogon desktop; any text following the prefix is executed as a command. Because this occurs entirely pre-authentication, it produces no logon event and bypasses conventional audit trails. Stupig additionally installs inline hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA to intercept credentials processed during legitimate logon attempts.
Investigators recovered two deployment names for the Stupig DLL on the victim host: it first appeared as a.dll on 2026-05-28 and was renamed to kbdus1.dll — closely mimicking the legitimate Windows keyboard-layout library kbdus.dll — on 2026-06-01. A third file, msyun.dll, was referenced in host artifacts but its payload could not be recovered.
The same host also carried Backdoor.Daxin, a signed Windows kernel-mode driver (deployed as srt64.sys in %SystemRoot%\System32\drivers) first documented by Symantec in 2022 but built on techniques dating to at least 2009 (predecessor malware Backdoor.Zala). Daxin operates as a SYSTEM-level rootkit that monitors all inbound TCP traffic for specific trigger patterns; upon match, it disconnects the legitimate recipient, hijacks the connection, and performs a custom encrypted key exchange to establish covert command-and-control. This lets Daxin operators relay a single command across a chain of infected hosts — each node's IP, TCP port, and key-exchange material supplied in one message — enabling operation deep inside air-gapped or heavily firewalled networks without generating anomalous outbound connections. Historically, Daxin activity has used masquerading driver names such as ipfltdrvs.sys, ndislan.sys, and sqlwriter.sys, and has targeted government, telecommunications, transportation, and manufacturing organizations of strategic interest to China.
Both the recovered Daxin driver (srt64.sys, compiled January 2013) and the Stupig DLL (compiled February 2013) carry compile timestamps only weeks apart, and Symantec noted shared development-practice similarities suggesting Stupig's author had access to or familiarity with Daxin's source code, though no direct code-level linkage between the two families was confirmed. The victim host did not begin producing telemetry until 2026-05-12, meaning the intrusion set — attributed to a China-linked threat actor — may have persisted undetected on the network for approximately 13 years. Symantec assesses initial access to the environment likely involved an outdated Digiwin single sign-on portal still running end-of-life Java Development Kit builds (JDK 1.5/1.6, released 2009-2011), though no specific CVE has been attributed to this initial-access path since the exploited weakness stems from unsupported/unpatched legacy software rather than a discrete disclosed vulnerability.
MITRE ATT&CK techniques used in TL-2026-1400
Defense Evasion
T1014 Rootkit; T1036 Masquerading
Lateral Movement
Credential Access
T1056 Input Capture; T1556 Modify Authentication Process
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Command and Control
T1090 Proxy; T1205 Traffic Signaling; T1573 Encrypted Channel
Persistence
T1505 Server Software Component; T1547 Boot or Logon Autostart Execution
Impact
Privilege Escalation
T1547 Boot or Logon Autostart Execution; T1548 Abuse Elevation Control Mechanism
defense-impairment
Affected products and versions in Backdoor.Stupig
- Microsoft — Windows (keyboard-layout provider / winlogon.exe subsystem)
Vulnerable versions: Windows hosts supporting keyboard-layout provider DLL registration - Digiwin — Single Sign-On Portal
Vulnerable versions: Instances running Java Development Kit 1.5 / 1.6 (JDK builds released 2009-2011)
Fixed in: Portal upgraded and JDK updated to a supported, patched release
Remediation for Backdoor.Stupig
Patches
- No CVE has been assigned; remediation is upgrade/decommission of the outdated Digiwin SSO portal and its unsupported JDK 1.5/1.6 runtime rather than a vendor patch
Immediate actions
- Hunt for unexpected keyboard-layout DLL registrations and modules loaded by winlogon.exe on all Windows hosts
- Enumerate drivers in %SystemRoot%\System32\drivers for unsigned/unexpected entries and lookalike filenames such as srt64.sys, kbdus1.dll, ipfltdrvs.sys, ndislan.sys, and sqlwriter.sys
- Compare loaded keyboard-layout DLL hashes/paths against the legitimate kbdus.dll to detect masquerading (e.g. kbdus1.dll)
- Isolate and forensically image any host exhibiting unauthenticated SYSTEM cmd.exe spawns from the Winlogon secure desktop
- Immediately decommission or fully patch the Digiwin single sign-on portal and any host still running end-of-life JDK 1.5/1.6
Workarounds
- Restrict or monitor registration of new keyboard-layout providers via Group Policy / registry auditing on HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layouts
- Disable or tightly restrict logon-screen username input where feasible on high-value hosts pending remediation
- Block loading of unsigned or newly-introduced drivers via WDAC/Device Guard on affected segments
Longer-term hardening
- Deploy EDR telemetry specifically covering winlogon.exe module-load events and keyboard-layout provider registry keys
- Implement network monitoring for anomalous inbound TCP connection hijacking / mid-session protocol changes on internal segments
- Establish a driver/DLL allow-listing baseline for authentication-path binaries (winlogon.exe, lsass.exe) across the fleet
- Conduct retrospective threat hunts across the full environment given the ~13-year suspected dwell time of this intrusion set
- Inventory and retire all internet- or SSO-facing services running end-of-life JDK/Java runtimes
Weaknesses (CWE) in Backdoor.Stupig
CWE-1188, CWE-306, CWE-284
Timeline of Backdoor.Stupig
- Backdoor.Zala, an earlier tool believed to be a Daxin predecessor, is active no later than this date, per Symantec's historical analysis of the intrusion set's toolkit evolution.
- The Backdoor.Daxin sample later recovered as srt64.sys carries a January 2013 compile timestamp.
- The Backdoor.Stupig sample carries a February 2013 compile timestamp, only weeks after the Daxin driver, suggesting a shared operational origin.
- Most recently known prior Daxin attack activity documented by Symantec before the 2022 public disclosure.
- Symantec publicly discloses Backdoor.Daxin for the first time, describing it as a highly sophisticated kernel-driver backdoor used by China-linked actors against hardened, air-gapped networks.
- Symantec's Threat Hunter Team investigates the compromised host in May 2026, identifying both Stupig and the resurfaced Daxin driver co-resident on the system.
- The compromised Taiwan-based subsidiary host begins producing telemetry observed by Symantec, despite the malware's 2013 compile timestamps — indicating up to roughly 13 years of undetected dwell time.
- The Stupig DLL is deployed on the victim host under the filename a.dll.
- The Stupig DLL is renamed to kbdus1.dll, closely mimicking the legitimate Windows keyboard-layout library kbdus.dll, to further blend in with the host's System32 directory.
- Symantec's findings on Backdoor.Stupig and the resurfaced Daxin activity are shared with and reported by multiple outlets, including Cyber Security News and GBHackers, making the campaign public.
Sources cited for Backdoor.Stupig
- Hackers Can Type a Secret Username at the Windows Login Screen
- China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
- Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor - Threat Radar
- Daxin (Malware Family)
Threats related to Backdoor.Stupig
- Daxin Rootkit Resurfaces After 13 Years: China-Linked Kernel Backdoor Found Alongside New Pre-Auth 'Stupig' DLL on Taiwan Manufacturer's Network
- Daxin Returns: China-Linked Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Backdoor
- Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Pre-Auth SYSTEM Backdoor
- VoidLink Linux Rootkit Framework — eBPF + LKM Hybrid Persistence with ICMP C2
Detection coverage for TL-2026-1400
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1400 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.