# Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Pre-Auth SYSTEM Backdoor

> Symantec's Threat Hunter Team discovered the China-linked Daxin kernel-mode rootkit (Backdoor.Daxin) active on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer, deployed alongside a previously undocumented backdoor, Backdoor.Stupig. Compile timestamps from January/February 2013 combined with telemetry only beginning in May 2026 indicate the intrusion may have persisted undetected for roughly 13 years. Stupig registers as a Windows keyboard-layout provider inside winlogon.exe to gain pre-authentication SYSTEM-level command execution and credential theft.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1404
- **ID:** TL-2026-1404
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Symantec's Threat Hunter Team identified Backdoor.Daxin, the highly sophisticated China-linked kernel-mode rootkit first disclosed publicly in 2022, still operational in 2026 on a compromised host belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer. Daxin is implemented as a signed Windows kernel driver (observed here as srt64.sys, SHA256 49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530) that operates without establishing any of its own outbound network connections. Instead, it passively monitors incoming TCP traffic on the host for specific trigger patterns; when a pattern is detected it disconnects the legitimate recipient of that session and hijacks the connection, performing a custom key-exchange to establish an encrypted command-and-control channel that rides on traffic that looks legitimate to network defenders. A single operator command can chain this hijacking capability across multiple already-compromised hosts, creating an automated multi-hop relay that lets the actor reach deeply isolated network segments without direct internet-facing egress from the target host itself. Daxin can start arbitrary processes and interact with them, effectively giving the operator interactive command execution capability across the relay chain.

Discovered on the same host was a previously undocumented backdoor, Backdoor.Stupig, whose novel tradecraft and shared 2013-era build timestamps suggest — though without confirmed code-level linkage — development by the same actor or an actor with access to Daxin's source. Stupig is a DLL (initially deployed as a.dll, later renamed and relocated to C:\Windows\System32\kbdus1.dll to mimic the legitimate Windows US keyboard-layout DLL kbdus.dll) that registers itself as a Windows keyboard-layout provider. This registration causes win32k.sys to load the DLL directly into winlogon.exe at system startup — an undocumented persistence and loading path distinct from, but conceptually related to, the classic Winlogon Helper DLL technique. Once loaded, Stupig returns a valid KBDTABLES pointer so normal keyboard-layout functionality is preserved and no functional anomaly is visible to the user. It then monitors the Windows logon screen (on the secure desktop, Winsta0\Winlogon) for usernames beginning with the prefix "stupig"; any text following that prefix is executed directly as SYSTEM before any user authentication occurs. If only the prefix is entered, Stupig spawns a SYSTEM-level command prompt directly on the logon screen. Because execution occurs pre-authentication, no successful logon audit event is generated — only a failed logon entry for an unusual username, which is easily lost in normal authentication noise. Stupig additionally installs inline hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA to intercept and harvest credentials as they are processed by the OS, and references a companion payload (msyun.dll) that Symantec was unable to recover for analysis.

Host telemetry for the compromised network did not begin until May 12, 2026, with the a.dll variant of Stupig first observed on May 28, 2026 and the renamed/relocated kbdus1.dll variant observed June 1, 2026. Because both Daxin and Stupig carry compile timestamps from January and February 2013 respectively, and the actor is known for long-term stealthy persistence in prior campaigns, Symantec assesses it is plausible the actor maintained undetected access to this network for more than a decade — roughly 13 years. The suspected initial-access vector for the broader intrusion is an outdated, internet-facing Digiwin single sign-on portal running long-end-of-life Java runtimes (JDK 1.5, end-of-life 2009, and JDK 1.6, end-of-life 2013), consistent with exploitation of unpatched legacy Java vulnerabilities rather than a novel zero-day.

Daxin was originally disclosed by Symantec in February 2022 as an extremely sophisticated backdoor designed for attacks against hardened, well-defended networks, historically deployed against governments, telecommunications, transportation, and manufacturing-sector organizations of strategic interest to China, often alongside loader/dropper tools tracked as Trojan.Owprox and Trojan.Emulov. The 2026 Taiwan finding confirms the tool remains in active operational use more than four years after public disclosure and detailed technical exposure — an unusually long operational lifespan for a publicly-burned nation-state implant, underscoring both the actor's tooling depth and the target's prior detection gaps. Taiwan's advanced electronics and high-tech manufacturing sector has been the subject of sustained, multi-campaign Chinese intrusion activity, and this incident fits that broader pattern of espionage targeting supply-chain-critical manufacturing entities.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1547 Boot or Logon Autostart Execution
- T1547.006 Kernel Modules and Extensions
- T1547 Boot or Logon Autostart Execution
- T1014 Rootkit
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1556 Modify Authentication Process
- T1111 Multi-Factor Authentication Interception
- T1049 System Network Connections Discovery
- T1570 Lateral Tool Transfer
- T1095 Non-Application Layer Protocol
- T1090.003 Multi-hop Proxy
- T1573 Encrypted Channel
- T1205 Traffic Signaling
- T1584.006 Web Services
- T1059 Command and Scripting Interpreter
- T1565 Data Manipulation

## Sources

- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor](https://www.security.com/blog-post/daxin-returns-stupig)
- [Malpedia library entry — win.daxin](https://malpedia.caad.fkie.fraunhofer.de/library/2e43fe9e-30e3-4540-95b4-f26bf1d38cc8/)
- [Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks](https://www.security.com/threat-intelligence/daxin-backdoor-espionage)
- [China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware](https://gbhackers.com/stupig-system-level-malware/)
- [Previously undocumented rootkit "Daxin" being deployed by Chinese APT](https://www.thestack.technology/daxin-chinese-malware-threat-sophisticated-symantec/)
- [Daxin Espionage Backdoor Ups the Ante on Chinese Malware](https://threatpost.com/daxin-espionage-backdoor-chinese-malware/178706/)
- [Symantec: Super-Stealthy 'Daxin' Backdoor Linked to Chinese Threat Actor](https://www.securityweek.com/symantec-super-stealthy-daxin-backdoor-linked-chinese-threat-actor/)
- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor (mirror)](https://www.hendryadrian.com/daxin-returns-stealthy-malware-resurfaces-in-taiwan-alongside-a-new-backdoor/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1404