# Daxin Rootkit Resurfaces After 13 Years: China-Linked Kernel Backdoor Found Alongside New Pre-Auth 'Stupig' DLL on Taiwan Manufacturer's Network

> Symantec's Threat Hunter Team found the China-linked Daxin kernel-mode rootkit (first documented in March 2022) still active on the network of a Taiwan-based subsidiary of a multinational high-tech manufacturer, with compile timestamps and evidence pointing to compromise dating back to 2013. Deployed alongside Daxin is a previously unreported companion backdoor, Stupig, a trojanized keyboard-layout DLL that loads into winlogon.exe and grants pre-authentication, SYSTEM-level code execution from the Windows logon screen.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1489
- **ID:** TL-2026-1489
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In May 2026, Symantec's Threat Hunter Team began receiving telemetry from a compromised host belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer. Investigation revealed the host was running Backdoor.Daxin, a sophisticated Windows kernel-mode rootkit that Symantec first publicly documented in March 2022 and, at the time, assessed as the most advanced malware it had observed from a China-linked actor. The driver component, srt64.sys, is installed under %SystemRoot%\System32\drivers and carries a January 2013 compile timestamp, indicating the implant (or a closely related build) has existed since at least that year — roughly 13 years of potential dwell time.

Daxin's defining characteristic is its command-and-control model: rather than initiating outbound connections that would stand out to network monitoring, the kernel driver passively inspects inbound TCP traffic for a specific trigger pattern, disconnects the legitimate recipient, and hijacks the existing TCP session to carry an encrypted C2 channel after a key exchange. This design lets Daxin operators relay commands through chains of compromised hosts (multi-hop) to reach systems on network segments with no direct internet egress, while generating minimal anomalous outbound traffic of its own.

Alongside Daxin, researchers identified a second, previously unreported implant they named Backdoor.Stupig. Stupig is a DLL (initially deployed as a.dll, later renamed kbdus1.dll) that masquerades as a legitimate Microsoft U.S. keyboard-layout library (kbdus.dll). It registers itself as a keyboard-layout provider so that win32k.sys loads it into winlogon.exe at system startup, and it returns a valid KBDTABLES pointer to avoid breaking keyboard functionality and evade casual inspection. Once resident in winlogon.exe, Stupig monitors the Windows logon screen for usernames beginning with the string "stupig"; any text following that prefix is executed as a SYSTEM-privileged command on the secure desktop before any user has authenticated. Because the interaction never completes a real logon, it produces an ordinary failed-login result rather than a distinguishable authentication event, leaving no meaningful audit trail. Stupig was also found hooking SspiCli!LsaLogonUser and Advapi32!CredUnprotectA inside winlogon.exe, indicating a credential-interception capability layered on top of the pre-auth command execution.

Stupig's DLL carries a February 2013 compile timestamp — one month after Daxin's driver — and researchers found no code-level overlap between the two implants. However, their co-deployment on the same host, complementary functionality (network-level stealth C2 versus pre-auth local execution), and near-identical 2013 build dates strongly suggest coordinated development and operation by the same or closely affiliated China-linked group, rather than coincidental co-infection.

The suspected initial access vector on the Taiwan subsidiary was an outdated Digiwin single sign-on (SSO) portal still running end-of-life Java Development Kit versions 1.5 and 1.6 — software lineage dating to 2009-2011 — consistent with a long-unpatched edge service providing an entry point that was never remediated. Symantec's telemetry timeline shows the host reporting activity from May 12, 2026, with a.dll first detected May 28, 2026, and the renamed kbdus1.dll variant observed June 1, 2026, triggering the investigation that ultimately traced both implants back to 2013-era tooling.

Separately, an unrelated but geographically and thematically adjacent C2 IP, 112.213[.]124.132, was reported sharing an identical HTTP header fingerprint with known TencShell C2 infrastructure — a Go-based implant derived from the open-source Rshell framework and previously documented by Cato CTRL as suspected China-linked tooling used against a global manufacturer. While TencShell is a distinct campaign/toolset from Daxin/Stupig, its overlap in targeting (manufacturing sector, China-linked attribution, 2026 timeframe) illustrates the broader pattern of China-linked operators maintaining long-lived, low-noise access to high-tech manufacturing and government targets across the Asia-Pacific region.

No CVE was assigned for this activity; the compromise pattern instead reflects abuse of an unpatched/EOL software stack (Digiwin SSO on legacy JDK) rather than exploitation of a specific disclosed vulnerability. Symantec's guidance to defenders emphasizes hunting for unexpected keyboard-layout DLL registrations, validating winlogon.exe module loads, inspecting system driver directories for unsigned or unusually-timestamped drivers, and treating any decade-plus operational gap between disclosure and re-discovery as evidence that legacy edge infrastructure needs active decommissioning, not just patching.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1014 Rootkit
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1685 Disable or Modify Tools
- T1556 Modify Authentication Process
- T1056 Input Capture
- T1205 Traffic Signaling
- T1572 Protocol Tunneling
- T1090 Proxy
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel

## Sources

- [Daxin 13-year-old China-linked malware found still active on manufacturer's network](https://securityaffairs.com/195577/malware/daxin-13-year-old-china-linked-malware-found-still-active-on-manufacturers-network.html)
- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor](https://www.security.com/blog-post/daxin-returns-stupig)
- [Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor](https://thehackernews.com/2026/07/daxin-resurfaces-in-taiwan-alongside.html)
- [China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware](https://gbhackers.com/stupig-system-level-malware/)
- [Daxin malware resurfaces with new backdoor targeting Taiwan manufacturer](https://www.scworld.com/brief/daxin-malware-resurfaces-with-new-backdoor-targeting-taiwan-manufacturer)
- [Chinese malware targeted multiple governments (original Daxin disclosure coverage)](https://www.theregister.com/security/2022/03/01/chinese-malware-targeted-multiple-governments/483871)
- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor - Threat Radar](https://radar.offseq.com/threat/daxin-returns-stealthy-malware-resurfaces-in-taiwa-c7747af5b6ae272e)
- [Daxin malware resurfaces in Taiwan alongside novel Stupig backdoor after decade-long silence](https://www.secureblink.com/threat-feeds/daxin-malware-resurfaces-in-taiwan-alongside-novel-stupig-backdoor-after-decade-long-silence)
- [Cato CTRL Threat Research: Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware](https://www.catonetworks.com/blog/cato-ctrl-suspected-china-linked-threat-actor-targets-global-manufacturer/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1489