Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Pre-Auth SYSTEM Backdoor
Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New (TL-2026-1404), also tracked as Daxin Returns, is a critical-severity malware campaign, first published 2026-07-16. It is linked to a China-nexus actor with medium confidence, affects Microsoft Windows (winlogon.exe / win32k.sys keyboard-layout, maps to 20 MITRE ATT&CK techniques (T1003, T1014, T1036.005), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-1404
- Threat ID
- TL-2026-1404
- Also known as
- Daxin Returns, Backdoor.Daxin, Backdoor.Stupig
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- manufacturing, high tech, government administration, telecoms, transport
- Target regions
- taiwan, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New
Malware and tooling: Backdoor.Daxin, Backdoor.Stupig, Trojan.Emulov, Trojan.Owprox
Symantec's Threat Hunter Team discovered the China-linked Daxin kernel-mode rootkit (Backdoor.Daxin) active on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer, deployed alongside a previously undocumented backdoor, Backdoor.Stupig. Compile timestamps from January/February 2013 combined with telemetry only beginning in May 2026 indicate the intrusion may have persisted undetected for roughly 13 years. Stupig registers as a Windows keyboard-layout provider inside winlogon.exe to gain pre-authentication SYSTEM-level command execution and credential theft.
How Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New works
Symantec's Threat Hunter Team identified Backdoor.Daxin, the highly sophisticated China-linked kernel-mode rootkit first disclosed publicly in 2022, still operational in 2026 on a compromised host belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer. Daxin is implemented as a signed Windows kernel driver (observed here as srt64.sys, SHA256 49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530) that operates without establishing any of its own outbound network connections. Instead, it passively monitors incoming TCP traffic on the host for specific trigger patterns; when a pattern is detected it disconnects the legitimate recipient of that session and hijacks the connection, performing a custom key-exchange to establish an encrypted command-and-control channel that rides on traffic that looks legitimate to network defenders. A single operator command can chain this hijacking capability across multiple already-compromised hosts, creating an automated multi-hop relay that lets the actor reach deeply isolated network segments without direct internet-facing egress from the target host itself. Daxin can start arbitrary processes and interact with them, effectively giving the operator interactive command execution capability across the relay chain.
Discovered on the same host was a previously undocumented backdoor, Backdoor.Stupig, whose novel tradecraft and shared 2013-era build timestamps suggest — though without confirmed code-level linkage — development by the same actor or an actor with access to Daxin's source. Stupig is a DLL (initially deployed as a.dll, later renamed and relocated to C:\Windows\System32\kbdus1.dll to mimic the legitimate Windows US keyboard-layout DLL kbdus.dll) that registers itself as a Windows keyboard-layout provider. This registration causes win32k.sys to load the DLL directly into winlogon.exe at system startup — an undocumented persistence and loading path distinct from, but conceptually related to, the classic Winlogon Helper DLL technique. Once loaded, Stupig returns a valid KBDTABLES pointer so normal keyboard-layout functionality is preserved and no functional anomaly is visible to the user. It then monitors the Windows logon screen (on the secure desktop, Winsta0\Winlogon) for usernames beginning with the prefix "stupig"; any text following that prefix is executed directly as SYSTEM before any user authentication occurs. If only the prefix is entered, Stupig spawns a SYSTEM-level command prompt directly on the logon screen. Because execution occurs pre-authentication, no successful logon audit event is generated — only a failed logon entry for an unusual username, which is easily lost in normal authentication noise. Stupig additionally installs inline hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA to intercept and harvest credentials as they are processed by the OS, and references a companion payload (msyun.dll) that Symantec was unable to recover for analysis.
Host telemetry for the compromised network did not begin until May 12, 2026, with the a.dll variant of Stupig first observed on May 28, 2026 and the renamed/relocated kbdus1.dll variant observed June 1, 2026. Because both Daxin and Stupig carry compile timestamps from January and February 2013 respectively, and the actor is known for long-term stealthy persistence in prior campaigns, Symantec assesses it is plausible the actor maintained undetected access to this network for more than a decade — roughly 13 years. The suspected initial-access vector for the broader intrusion is an outdated, internet-facing Digiwin single sign-on portal running long-end-of-life Java runtimes (JDK 1.5, end-of-life 2009, and JDK 1.6, end-of-life 2013), consistent with exploitation of unpatched legacy Java vulnerabilities rather than a novel zero-day.
Daxin was originally disclosed by Symantec in February 2022 as an extremely sophisticated backdoor designed for attacks against hardened, well-defended networks, historically deployed against governments, telecommunications, transportation, and manufacturing-sector organizations of strategic interest to China, often alongside loader/dropper tools tracked as Trojan.Owprox and Trojan.Emulov. The 2026 Taiwan finding confirms the tool remains in active operational use more than four years after public disclosure and detailed technical exposure — an unusually long operational lifespan for a publicly-burned nation-state implant, underscoring both the actor's tooling depth and the target's prior detection gaps. Taiwan's advanced electronics and high-tech manufacturing sector has been the subject of sustained, multi-campaign Chinese intrusion activity, and this incident fits that broader pattern of espionage targeting supply-chain-critical manufacturing entities.
MITRE ATT&CK techniques used in TL-2026-1404
Credential Access
T1003 OS Credential Dumping; T1111 Multi-Factor Authentication Interception; T1556 Modify Authentication Process
Defense Evasion
T1014 Rootkit; T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal
Discovery
T1049 System Network Connections Discovery
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1090.003 Multi-hop Proxy; T1095 Non-Application Layer Protocol; T1205 Traffic Signaling; T1573 Encrypted Channel
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1547 Boot or Logon Autostart Execution; T1547.006 Kernel Modules and Extensions
Privilege Escalation
T1547 Boot or Logon Autostart Execution
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
Impact
Lateral Movement
resource-development
Affected products and versions in Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New
- Microsoft — Windows (winlogon.exe / win32k.sys keyboard-layout subsystem)
Vulnerable versions: Windows hosts supporting legacy keyboard-layout provider registration - Digiwin — Single Sign-On Portal (suspected initial access vector, running end-of-life JDK 1.5/1.6)
Vulnerable versions: Installations using JDK 1.5 (EOL 2009) or JDK 1.6 (EOL 2013)
Fixed in: Upgrade underlying JRE/JDK to a supported version and patch the portal
Remediation for Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New
Patches
- No specific CVE identified; remediation is retirement/upgrade of end-of-life JDK 1.5/1.6 underlying the Digiwin SSO portal, not a single vendor patch
Immediate actions
- Isolate and forensically image the affected Taiwan subsidiary host before remediation
- Hunt for srt64.sys and other known Daxin kernel-driver filenames across the fleet (ipfltdrvs.sys, patrol.sys, and related aliases)
- Hunt for kbdus1.dll and a.dll in %SystemRoot% and %SystemRoot%\System32, comparing hashes/signatures against the legitimate kbdus.dll
- Audit and disable/patch the internet-facing Digiwin single sign-on portal; retire end-of-life JDK 1.5/1.6 runtimes immediately
- Review Windows Security event logs for failed logon attempts with usernames beginning with the string 'stupig'
- Rotate all credentials that may have transited the host, given confirmed LsaLogonUser/CredUnprotectA hooking
Workarounds
- Restrict logon-screen input handling / keyboard-layout provider registration via group policy where feasible
- Disable or tightly restrict remote/interactive access to the secure desktop (Winsta0\Winlogon) on exposed hosts
Longer-term hardening
- Deploy kernel-driver allowlisting / Windows Defender Application Control (WDAC) to block unauthorized signed drivers from loading
- Implement network traffic baselining to detect anomalous TCP session hijack patterns on internal segments
- Enforce regular decommissioning/patching cadence for internet-facing enterprise portals (SSO, ERP) and their embedded runtimes
- Deploy EDR with kernel callback monitoring and driver load telemetry, not solely network-perimeter monitoring
- Implement credential-guard / LSA protection (RunAsPPL) to reduce viability of LSA API hooking techniques
Weaknesses (CWE) in Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New
CWE-284, CWE-506, CWE-522, CWE-693
Timeline of Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New
- Backdoor.Daxin driver (srt64.sys) carries a compile timestamp of January 2013.
- Backdoor.Stupig DLL (a.dll) carries a compile timestamp of February 2013, suggesting shared or contemporaneous development with Daxin.
- Most recent previously known Daxin activity (per original 2022 Symantec disclosure) observed in November 2021.
- Symantec publicly discloses Backdoor.Daxin as a highly sophisticated kernel-mode backdoor used against hardened government, telecom, transportation, and manufacturing networks.
- Host telemetry for the affected Taiwan subsidiary network begins recording, the earliest point at which Symantec has visibility into the compromised host.
- Stupig backdoor first observed on the host as a.dll.
- Stupig observed renamed and relocated to C:\Windows\System32\kbdus1.dll, masquerading as the legitimate kbdus.dll.
- Multiple outlets (GBHackers, SecurityWeek-adjacent aggregators, threat radar feeds) republish and analyze the Symantec findings.
- Symantec Threat Hunter Team publishes 'Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor,' disclosing the joint Daxin/Stupig intrusion and assessing up to 13 years of undetected persistence.
Sources cited for Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
- Malpedia library entry — win.daxin
- Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks
- China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware
- Previously undocumented rootkit "Daxin" being deployed by Chinese APT
- Daxin Espionage Backdoor Ups the Ante on Chinese Malware
- Symantec: Super-Stealthy 'Daxin' Backdoor Linked to Chinese Threat Actor
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor (mirror)
Threats related to Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New
- Daxin Returns: China-Linked Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Backdoor
- Backdoor.Stupig — Windows Login-Screen Keyboard-Layout Provider Backdoor Grants SYSTEM Access, Deployed Alongside Resurfaced Daxin
- Daxin Rootkit Resurfaces After 13 Years: China-Linked Kernel Backdoor Found Alongside New Pre-Auth 'Stupig' DLL on Taiwan Manufacturer's Network
- VoidLink Linux Rootkit Framework — eBPF + LKM Hybrid Persistence with ICMP C2
Detection coverage for TL-2026-1404
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1404 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.