Threat reportMalwareTL-2026-4700
Daxin Returns: China-linked Backdoor.Daxin kernel rootkit and new Backdoor.Stupig (keyboard-layout DLL in winlogon.exe) found in Taiwan
Daxin Returns (TL-2026-4700), also tracked as Daxin, is a high-severity malware campaign, first published 2026-10-29. It is attributed to Daxin operators (China) with medium confidence, affects Microsoft Windows (kernel driver loading and winlogon.exe, maps to 10 MITRE ATT&CK techniques (T1014, T1036.005, T1056), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 1Daxin operators
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4700
- Threat ID
- TL-2026-4700
- Also known as
- Daxin, Backdoor.Daxin, Backdoor.Stupig
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Daxin operators
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- manufacturing, high-technology, government administration, telecoms, transport
- Target regions
- taiwan, East Asia
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Daxin Returns
Malware and tooling: Backdoor.Daxin, Backdoor.Stupig, Daxin
How Daxin Returns works
Symantec and Carbon Black Threat Hunter Team found the stealthy Backdoor.Daxin kernel-mode rootkit active again, alongside a previously unreported backdoor, Backdoor.Stupig, on a host at a Taiwan-based subsidiary of a multinational high-tech manufacturer. The activity is attributed to a China-linked espionage operation; both samples carry 2013 compile timestamps, suggesting the intrusion may have been dormant for years.
Symantec's Threat Hunter Team reported (2026-07-15) the resurfacing of Backdoor.Daxin, a Windows kernel-mode driver backdoor first publicly documented by Symantec in 2022 and used in a long-running China-linked espionage campaign against governments and the telecommunications, transportation and manufacturing sectors. The victim in this case is a Taiwan-based subsidiary of a multinational high-tech manufacturer. The host began reporting telemetry on 2026-05-12. Symantec assesses that the compromise likely originated through an outdated Digiwin single sign-on (SSO) portal running end-of-life JDK 1.5 and 1.6 (software deployed 2009-2011).
Backdoor.Daxin (srt64.sys) is a digitally signed Windows kernel-mode driver located in %SystemRoot%\System32\drivers with a January 2013 compile timestamp. Rather than opening its own outbound connections, the driver monitors incoming TCP traffic for specific patterns and hijacks legitimate existing connections to carry encrypted command-and-control traffic. It supports multi-hop communication through chains of infected hosts, allowing operators to reach network segments that have no direct internet connectivity and to execute commands on them. This makes it exceptionally difficult to identify with conventional network monitoring.
Backdoor.Stupig is a newly documented DLL backdoor (February 2013 compile timestamp), first seen on 2026-05-28 as a.dll in the Windows directory and on 2026-06-01 as kbdus1.dll in System32, masquerading as the legitimate U.S. English keyboard layout kbdus.dll. It persists by registering as a keyboard-layout provider so that win32k.sys loads it into winlogon.exe at system startup; Symantec describes this as a technique not documented in any known malware family. The DLL returns a valid KBDTABLES pointer so the keyboard layout continues to function normally. Inside winlogon.exe it monitors the logon screen for usernames beginning with the string 'stupig' and executes the following text as commands with SYSTEM privileges from the secure desktop (Winsta0\Winlogon), before any user signs in and without raising anomalous audit events beyond failed-logon entries. It installs inline hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA (using VirtualProtect, ZwAllocateVirtualMemory and memcpy) and references a companion payload via LoadLibraryA('msyun.dll'), which was not recovered.
Symantec found no code-level overlap between Daxin and Stupig; the link rests on deployment on the same host, complementary functionality and matching 2013 compile timestamps. No C2 IPs or domains, CVEs or registry values were published, so network-IOC correlation (BeaconBeagle) returned nothing. Symantec detects the activity as Backdoor.Daxin and Backdoor.Stupig.
MITRE ATT&CK techniques used in TL-2026-4700
Defense Evasion
T1014 Rootkit; T1036.005 Masquerading: Match Legitimate Resource Name or Location
Credential Access
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1090.001 Proxy: Internal Proxy; T1205 Traffic Signaling; T1573 Encrypted Channel
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL
defense-impairment
Affected products and versions in Daxin Returns
- Microsoft — Windows (kernel driver loading and winlogon.exe keyboard-layout loading)
Vulnerable versions: Systems where the malware is installed - Digiwin — Single sign-on (SSO) portal running JDK 1.5/1.6
Vulnerable versions: Outdated deployments on end-of-life JDK 1.5 and 1.6
Remediation for Daxin Returns
Patches
- Upgrade the Java runtime and Digiwin SSO components to vendor-supported versions
Immediate actions
- Hunt for srt64.sys in %SystemRoot%\System32\drivers and for kbdus1.dll / a.dll in the Windows and System32 directories; block the published SHA256 hashes
- Inspect keyboard-layout registrations (HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layouts) for DLL names that differ from stock Windows layouts, and review modules loaded into winlogon.exe
- Review failed-logon events (4625) for usernames beginning with 'stupig'
- Isolate and forensically image any host where Daxin or Stupig is found; reset credentials that may have been intercepted via LsaLogonUser/CredUnprotectA hooks
Workarounds
- Restrict inbound access to legacy SSO portals until they can be upgraded
- Apply Symantec protection updates for Backdoor.Daxin and Backdoor.Stupig
Longer-term hardening
- Retire or upgrade internet-facing legacy applications running end-of-life JDK 1.5/1.6, including the Digiwin SSO portal
- Enforce Windows driver blocklists / HVCI and monitor new kernel driver installs, including validly signed drivers
- Deploy EDR with kernel-driver and winlogon.exe module-load telemetry; segment networks and monitor for anomalous inter-host relay traffic
Timeline of Daxin Returns
- Daxin driver sample (srt64.sys) carries a January 2013 compile timestamp; Symantec's earlier research traced Daxin use back to at least 2013.
- Stupig DLL sample (a.dll / kbdus1.dll) carries a February 2013 compile timestamp.
- Symantec first publicly documents Backdoor.Daxin as a sophisticated China-linked kernel-mode backdoor used against governments, telecommunications, transportation and manufacturing; most recent known use at that time was November 2021.
- The compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer begins reporting telemetry to Symantec/Carbon Black.
- Backdoor.Stupig first detected as a.dll in the Windows directory.
- Stupig observed renamed as kbdus1.dll in System32, masquerading as the legitimate kbdus.dll keyboard layout.
- Symantec and Carbon Black Threat Hunter Team publish 'Daxin Returns', disclosing Daxin resurfacing alongside the new Stupig backdoor.
Sources cited for Daxin Returns
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
- Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor (The Hacker News)
- Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network (Security Affairs)
- Stupig Windows Backdoor Opens SYSTEM Shell From Login Screen (VPNCentral)
- Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade-Long Silence (SecureBlink)
- Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor (Aviatrix Threat Research Center)
- China-linked Daxin malware targeted governments (The Hacker News, 2022)
- China-linked APT used Daxin, one of the most sophisticated backdoor ever seen (Security Affairs, 2022)
- Newly Discovered Malware Evades Detection by Hijacking Communications (eSecurity Planet)
Detection coverage for TL-2026-4700
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4700 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.