Daxin Rootkit Resurfaces After 13 Years: China-Linked Kernel Backdoor Found Alongside New Pre-Auth 'Stupig' DLL on Taiwan Manufacturer's Network
Daxin Rootkit Resurfaces After 13 Years (TL-2026-1489), also tracked as Backdoor.Daxin, is a high-severity malware campaign, first published 2026-07-18. It is linked to a China-nexus actor with medium confidence, affects Microsoft Windows (kernel driver / winlogon.exe subsystem), maps to 18 MITRE ATT&CK techniques (T1014, T1036, T1041), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1489
- Threat ID
- TL-2026-1489
- Also known as
- Backdoor.Daxin, Backdoor.Stupig, Daxin Resurgence
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- manufacturing, high tech, government administration, telecoms, transport
- Target regions
- taiwan, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Daxin Rootkit Resurfaces After 13 Years
Malware and tooling: Daxin, Stupig, TencShell
Symantec's Threat Hunter Team found the China-linked Daxin kernel-mode rootkit (first documented in March 2022) still active on the network of a Taiwan-based subsidiary of a multinational high-tech manufacturer, with compile timestamps and evidence pointing to compromise dating back to 2013. Deployed alongside Daxin is a previously unreported companion backdoor, Stupig, a trojanized keyboard-layout DLL that loads into winlogon.exe and grants pre-authentication, SYSTEM-level code execution from the Windows logon screen.
How Daxin Rootkit Resurfaces After 13 Years works
In May 2026, Symantec's Threat Hunter Team began receiving telemetry from a compromised host belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer. Investigation revealed the host was running Backdoor.Daxin, a sophisticated Windows kernel-mode rootkit that Symantec first publicly documented in March 2022 and, at the time, assessed as the most advanced malware it had observed from a China-linked actor. The driver component, srt64.sys, is installed under %SystemRoot%\System32\drivers and carries a January 2013 compile timestamp, indicating the implant (or a closely related build) has existed since at least that year — roughly 13 years of potential dwell time.
Daxin's defining characteristic is its command-and-control model: rather than initiating outbound connections that would stand out to network monitoring, the kernel driver passively inspects inbound TCP traffic for a specific trigger pattern, disconnects the legitimate recipient, and hijacks the existing TCP session to carry an encrypted C2 channel after a key exchange. This design lets Daxin operators relay commands through chains of compromised hosts (multi-hop) to reach systems on network segments with no direct internet egress, while generating minimal anomalous outbound traffic of its own.
Alongside Daxin, researchers identified a second, previously unreported implant they named Backdoor.Stupig. Stupig is a DLL (initially deployed as a.dll, later renamed kbdus1.dll) that masquerades as a legitimate Microsoft U.S. keyboard-layout library (kbdus.dll). It registers itself as a keyboard-layout provider so that win32k.sys loads it into winlogon.exe at system startup, and it returns a valid KBDTABLES pointer to avoid breaking keyboard functionality and evade casual inspection. Once resident in winlogon.exe, Stupig monitors the Windows logon screen for usernames beginning with the string "stupig"; any text following that prefix is executed as a SYSTEM-privileged command on the secure desktop before any user has authenticated. Because the interaction never completes a real logon, it produces an ordinary failed-login result rather than a distinguishable authentication event, leaving no meaningful audit trail. Stupig was also found hooking SspiCli!LsaLogonUser and Advapi32!CredUnprotectA inside winlogon.exe, indicating a credential-interception capability layered on top of the pre-auth command execution.
Stupig's DLL carries a February 2013 compile timestamp — one month after Daxin's driver — and researchers found no code-level overlap between the two implants. However, their co-deployment on the same host, complementary functionality (network-level stealth C2 versus pre-auth local execution), and near-identical 2013 build dates strongly suggest coordinated development and operation by the same or closely affiliated China-linked group, rather than coincidental co-infection.
The suspected initial access vector on the Taiwan subsidiary was an outdated Digiwin single sign-on (SSO) portal still running end-of-life Java Development Kit versions 1.5 and 1.6 — software lineage dating to 2009-2011 — consistent with a long-unpatched edge service providing an entry point that was never remediated. Symantec's telemetry timeline shows the host reporting activity from May 12, 2026, with a.dll first detected May 28, 2026, and the renamed kbdus1.dll variant observed June 1, 2026, triggering the investigation that ultimately traced both implants back to 2013-era tooling.
Separately, an unrelated but geographically and thematically adjacent C2 IP, 112.213[.]124.132, was reported sharing an identical HTTP header fingerprint with known TencShell C2 infrastructure — a Go-based implant derived from the open-source Rshell framework and previously documented by Cato CTRL as suspected China-linked tooling used against a global manufacturer. While TencShell is a distinct campaign/toolset from Daxin/Stupig, its overlap in targeting (manufacturing sector, China-linked attribution, 2026 timeframe) illustrates the broader pattern of China-linked operators maintaining long-lived, low-noise access to high-tech manufacturing and government targets across the Asia-Pacific region.
No CVE was assigned for this activity; the compromise pattern instead reflects abuse of an unpatched/EOL software stack (Digiwin SSO on legacy JDK) rather than exploitation of a specific disclosed vulnerability. Symantec's guidance to defenders emphasizes hunting for unexpected keyboard-layout DLL registrations, validating winlogon.exe module loads, inspecting system driver directories for unsigned or unusually-timestamped drivers, and treating any decade-plus operational gap between disclosure and re-discovery as evidence that legacy edge infrastructure needs active decommissioning, not just patching.
MITRE ATT&CK techniques used in TL-2026-1489
Defense Evasion
T1014 Rootkit; T1036 Masquerading
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056 Input Capture; T1556 Modify Authentication Process
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1547 Boot or Logon Autostart Execution
Command and Control
T1090 Proxy; T1205 Traffic Signaling; T1572 Protocol Tunneling; T1573 Encrypted Channel
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Resource Development
Affected products and versions in Daxin Rootkit Resurfaces After 13 Years
- Microsoft — Windows (kernel driver / winlogon.exe subsystem)
Vulnerable versions: All Windows versions supporting third-party kernel drivers and keyboard-layout DLL providers - Digiwin — Single Sign-On (SSO) portal
Vulnerable versions: Instances running end-of-life Java Development Kit 1.5 / 1.6 (2009-2011 era)
Fixed in: Upgrade to a currently supported JDK and patched Digiwin SSO release
Remediation for Daxin Rootkit Resurfaces After 13 Years
Patches
- Upgrade Digiwin SSO portal and underlying Java runtime to a currently supported, patched version
- No vendor CVE patch applicable; remediation is configuration/decommissioning-based since no CVE was assigned
Immediate actions
- Hunt for the file srt64.sys under %SystemRoot%\System32\drivers and validate every kernel driver's signature, publisher, and compile timestamp against expected baselines
- Enumerate all registered keyboard-layout DLLs/providers on Windows hosts and flag any not matching known-good Microsoft filenames and hashes, including any variant of kbdus1.dll or a.dll
- Audit winlogon.exe for unexpected loaded modules and unusual API hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA
- Block/alert on outbound and inbound traffic to 112.213[.]124.132 and any host sharing the reported TencShell HTTP header fingerprint on port 1111
- Immediately decommission or upgrade any Digiwin SSO portal instances still running end-of-life JDK 1.5/1.6
Workarounds
- Restrict or disable the affected legacy Digiwin SSO portal from internet exposure until upgraded
- Enforce driver signature enforcement policies and allow-list known-good kernel drivers to block unsigned/rogue driver loads
- Require multi-factor, out-of-band verification for any SYSTEM-level process spawned from the Windows logon screen path
Longer-term hardening
- Deploy EDR with kernel-driver load monitoring and behavioral detection for TCP connection hijacking patterns
- Establish a legacy-software decommissioning program for internet-facing SSO/identity portals running EOL Java runtimes
- Implement network segmentation to limit multi-hop C2 relay paths between internet-facing and isolated internal segments
- Add continuous integrity monitoring for %SystemRoot%\System32\drivers and winlogon.exe module load events to SIEM baselines
Weaknesses (CWE) in Daxin Rootkit Resurfaces After 13 Years
CWE-1104
Timeline of Daxin Rootkit Resurfaces After 13 Years
- Digiwin SSO portal running end-of-life Java Development Kit 1.5/1.6 (2009-2011 software lineage) is deployed at the eventual victim organization, later assessed as the likely initial access vector
- Daxin kernel driver (srt64.sys) compiled, per PE compile timestamp
- Stupig DLL backdoor (a.dll) compiled, one month after the Daxin driver, per PE compile timestamp
- Suspected initial compromise of the Taiwan-based manufacturer subsidiary based on the coordinated 2013 compile timestamps of both implants
- Symantec publicly documents Backdoor.Daxin for the first time as a highly advanced China-linked kernel-mode rootkit
- Symantec Threat Hunter Team begins receiving telemetry from the compromised Taiwan host, triggering renewed investigation
- Stupig backdoor first detected on the host as a.dll
- Renamed Stupig variant observed as kbdus1.dll, masquerading as the legitimate Microsoft keyboard-layout library
- Security Affairs, The Hacker News, GBHackers, SC Media and other outlets publish coverage of Symantec's findings on the Daxin resurgence and newly discovered Stupig backdoor
Sources cited for Daxin Rootkit Resurfaces After 13 Years
- Daxin 13-year-old China-linked malware found still active on manufacturer's network
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
- Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor
- China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware
- Daxin malware resurfaces with new backdoor targeting Taiwan manufacturer
- Chinese malware targeted multiple governments (original Daxin disclosure coverage)
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor - Threat Radar
- Daxin malware resurfaces in Taiwan alongside novel Stupig backdoor after decade-long silence
- Cato CTRL Threat Research: Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware
Threats related to Daxin Rootkit Resurfaces After 13 Years
- Daxin Returns: China-Linked Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Backdoor
- Backdoor.Stupig — Windows Login-Screen Keyboard-Layout Provider Backdoor Grants SYSTEM Access, Deployed Alongside Resurfaced Daxin
- Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Pre-Auth SYSTEM Backdoor
- FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to Windows — WIN_DRV (RawWNPF Kernel Rootkit) & WIN_PLUS Variants
- VoidLink Linux Rootkit Framework — eBPF + LKM Hybrid Persistence with ICMP C2
- China-Linked Threat Actor Integrates Claude Code and DeepSeek-v4-pro into Active Espionage Operations Against Government, Supply-Chain, and Financial Targets
Detection coverage for TL-2026-1489
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1489 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1489
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.