Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Pre-Auth SYSTEM Backdoor — Threadlinqs Intelligence
As of 2026-07-16, Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Pre-Auth SYSTEM Backdoor is a critical-severity malware threat attributed to China-linked espionage actor (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1404 · Severity: CRITICAL · Status: ACTIVE · Category: MALWARE
Attribution: China-linked espionage actor · China · ESPIONAGE
Symantec's Threat Hunter Team discovered the China-linked Daxin kernel-mode rootkit (Backdoor.Daxin) active on a compromised host at a Taiwan-based subsidiary of a multinational high-tech
Symantec's Threat Hunter Team identified Backdoor.Daxin, the highly sophisticated China-linked kernel-mode rootkit first disclosed publicly in 2022, still operational in 2026 on a compromised host belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer. Daxin is implemented as a signed Windows kernel driver (observed here as srt64.sys, SHA256 49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530) that operates without establishing any of its own outbound network connections. Instead, it passively monitors incoming TCP traffic on the host for specific trigger patterns; when a pattern is detected it disconnects the legitimate recipient of that session and hijacks the connection, performing a custom key-exchange to establish an encrypted command-and-control channel that rides on traffic that looks legitimate to network defenders. A single operator command can chain this hijacking capability across multiple already-compromised hosts, creating an automated multi-hop relay that lets the actor reach deeply isolated network segments without direct internet-facing egress from the target host itself. Daxin can start arbitrary processes and interact with them, effectively giving the operator interactive command execution capability across the relay chain.
Discovered on the same host was a previously undocumented backdoor, Backdoor.Stupig, whose novel tradecraft and shared 2013-era build timestamps suggest — though without confirmed code-level linkage — development by the same actor or an actor with access to Daxin's source. Stupig is a DLL (initially deployed as a.dll, later renamed and relocated to C:\Windows\System32\kbdus1.dll to mimic the legitimate Windows US keyboard-layout DLL kbdus.dll) that registers itself as a Windows keyboard-layout provider. This registration causes win32k.sys to load the DLL directly into winlogon.exe at system startup — an undocumented persistence and loading path distinct from, but conceptually related to, the classic Winlogon Helper DLL technique. Once loaded, Stupig returns a valid KBDTABLES pointer so normal keyboard-layout functionality is preserved and no functional anomaly is visible to the user. It then monitors the Windows logon screen (on the secure desktop, Winsta0\Winlogon) for usernames beginning with the prefix "stupig"; any text following that prefix is executed directly as SYSTEM before any user authentication occurs. If only the prefix is entered, Stupig spawns a SYSTEM-level command prompt directly on the logon screen. Because execution occurs pre-authentication, no successful logon audit event is generated — only a failed logon entry for an unusual username, which is easily lost in normal authentication noise. Stupig additionally installs inline hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA to intercept and harvest credentials as they are processed by the OS, and references a companion payload (msyun.dll) that Symantec was unable to recover for analysis.
Host telemetry for the compromised network did not begin until May 12, 2026, with the a.dll variant of Stupig first observed on May 28, 2026 and the renamed/relocated kbdus1.dll variant observed June 1, 2026. Because both Daxin and Stupig carry compile timestamps from January and February 2013 respectively, and the actor is known for long-term stealthy persistence in prior campaigns, Symantec assesses it is plausible the actor maintained undetected access to this network for more than a decade — roughly 13 years. The suspected initial-access vector for the broader intrusion is an outdated, internet-facing Digiwin single sign-on portal running long-end-of-life Java runtimes (JDK 1.5, end-of-life 2009, and JDK 1.6, end-of-life 2013), consistent with exploitation of unpatched legacy Java vulnerabilities rather than a novel zero-day.
Daxin was originally disclosed by Symantec in February 2022 as an extremely sophisticated backdoor designed for attacks against hardened, well-defended networks
Weaknesses (CWE)
CWE-284, CWE-506, CWE-522, CWE-693
Target sectors: manufacturing, high tech, government administration, telecoms, transport
Target regions: taiwan, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1190, T1547, T1547.006, T1547, T1014, T1036.005, T1553.002, T1070, T1562, T1003