# Backdoor.Stupig — Windows Login-Screen Keyboard-Layout Provider Backdoor Grants SYSTEM Access, Deployed Alongside Resurfaced Daxin

> Symantec's Threat Hunter Team discovered Backdoor.Stupig, a novel Windows implant that registers as a malicious keyboard-layout provider DLL loaded into winlogon.exe at startup; typing a username beginning with "stupig" at the Windows logon screen spawns a SYSTEM-level command prompt on the secure Winlogon desktop, with any trailing text executed as a command, all before authentication and without generating a logon audit event. Stupig was found co-deployed on a compromised Taiwan-based subsidiary of a multinational high-tech manufacturer alongside Backdoor.Daxin, the sophisticated China-linked kernel-driver backdoor first publicly exposed in 2022, with both samples carrying compile timestamps from early 2013 — suggesting the intrusion went undetected for roughly 13 years. Initial access is believed to have involved an outdated Digiwin single sign-on portal running Java Development Kit builds from 2009-2011 (JDK 1.5/1.6), both long past end of life.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1400
- **ID:** TL-2026-1400
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In May 2026, Symantec's Threat Hunter Team identified telemetry from a previously unknown backdoor — Backdoor.Stupig — running on a compromised host belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer. Stupig masquerades as a legitimate Windows keyboard-layout component. By registering itself through the OS's keyboard-layout provider extensibility mechanism, Windows loads the malicious DLL into winlogon.exe at system startup, before any user authenticates. The DLL passes through normal keyboard data to avoid detection while silently monitoring the logon screen's username field. If an operator types a username beginning with the prefix "stupig," the malware launches a SYSTEM-privileged command prompt directly on the secure Winlogon desktop; any text following the prefix is executed as a command. Because this occurs entirely pre-authentication, it produces no logon event and bypasses conventional audit trails. Stupig additionally installs inline hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA to intercept credentials processed during legitimate logon attempts.

Investigators recovered two deployment names for the Stupig DLL on the victim host: it first appeared as a.dll on 2026-05-28 and was renamed to kbdus1.dll — closely mimicking the legitimate Windows keyboard-layout library kbdus.dll — on 2026-06-01. A third file, msyun.dll, was referenced in host artifacts but its payload could not be recovered.

The same host also carried Backdoor.Daxin, a signed Windows kernel-mode driver (deployed as srt64.sys in %SystemRoot%\System32\drivers) first documented by Symantec in 2022 but built on techniques dating to at least 2009 (predecessor malware Backdoor.Zala). Daxin operates as a SYSTEM-level rootkit that monitors all inbound TCP traffic for specific trigger patterns; upon match, it disconnects the legitimate recipient, hijacks the connection, and performs a custom encrypted key exchange to establish covert command-and-control. This lets Daxin operators relay a single command across a chain of infected hosts — each node's IP, TCP port, and key-exchange material supplied in one message — enabling operation deep inside air-gapped or heavily firewalled networks without generating anomalous outbound connections. Historically, Daxin activity has used masquerading driver names such as ipfltdrvs.sys, ndislan.sys, and sqlwriter.sys, and has targeted government, telecommunications, transportation, and manufacturing organizations of strategic interest to China.

Both the recovered Daxin driver (srt64.sys, compiled January 2013) and the Stupig DLL (compiled February 2013) carry compile timestamps only weeks apart, and Symantec noted shared development-practice similarities suggesting Stupig's author had access to or familiarity with Daxin's source code, though no direct code-level linkage between the two families was confirmed. The victim host did not begin producing telemetry until 2026-05-12, meaning the intrusion set — attributed to a China-linked threat actor — may have persisted undetected on the network for approximately 13 years. Symantec assesses initial access to the environment likely involved an outdated Digiwin single sign-on portal still running end-of-life Java Development Kit builds (JDK 1.5/1.6, released 2009-2011), though no specific CVE has been attributed to this initial-access path since the exploited weakness stems from unsupported/unpatched legacy software rather than a discrete disclosed vulnerability.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1505 Server Software Component
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1014 Rootkit
- T1036 Masquerading
- T1556 Modify Authentication Process
- T1056 Input Capture
- T1556 Modify Authentication Process
- T1573 Encrypted Channel
- T1090 Proxy
- T1205 Traffic Signaling
- T1021 Remote Services
- T1529 System Shutdown/Reboot

## Sources

- [Hackers Can Type a Secret Username at the Windows Login Screen](https://cybersecuritynews.com/hackers-can-type-a-secret-username-at-the-windows-login-screen/)
- [China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware](https://gbhackers.com/stupig-system-level-malware/)
- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor](https://www.security.com/blog-post/daxin-returns-stupig)
- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor](https://www.hendryadrian.com/daxin-returns-stealthy-malware-resurfaces-in-taiwan-alongside-a-new-backdoor/)
- [Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks](https://www.security.com/threat-intelligence/daxin-backdoor-espionage)
- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor - Threat Radar](https://radar.offseq.com/threat/daxin-returns-stealthy-malware-resurfaces-in-taiwa-c7747af5b6ae272e)
- [Daxin (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.daxin)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1400