# Daxin Returns: China-linked Backdoor.Daxin kernel rootkit and new Backdoor.Stupig (keyboard-layout DLL in winlogon.exe) found in Taiwan

> Symantec and Carbon Black Threat Hunter Team found the stealthy Backdoor.Daxin kernel-mode rootkit active again, alongside a previously unreported backdoor, Backdoor.Stupig, on a host at a Taiwan-based subsidiary of a multinational high-tech manufacturer. The activity is attributed to a China-linked espionage operation; both samples carry 2013 compile timestamps, suggesting the intrusion may have been dormant for years.

- **Published:** 2026-10-29T03:45:26Z
- **Last reviewed:** 2026-10-29T03:45:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4700
- **ID:** TL-2026-4700
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Daxin operators (China)
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Symantec's Threat Hunter Team reported (2026-07-15) the resurfacing of Backdoor.Daxin, a Windows kernel-mode driver backdoor first publicly documented by Symantec in 2022 and used in a long-running China-linked espionage campaign against governments and the telecommunications, transportation and manufacturing sectors. The victim in this case is a Taiwan-based subsidiary of a multinational high-tech manufacturer. The host began reporting telemetry on 2026-05-12. Symantec assesses that the compromise likely originated through an outdated Digiwin single sign-on (SSO) portal running end-of-life JDK 1.5 and 1.6 (software deployed 2009-2011).

Backdoor.Daxin (srt64.sys) is a digitally signed Windows kernel-mode driver located in %SystemRoot%\System32\drivers with a January 2013 compile timestamp. Rather than opening its own outbound connections, the driver monitors incoming TCP traffic for specific patterns and hijacks legitimate existing connections to carry encrypted command-and-control traffic. It supports multi-hop communication through chains of infected hosts, allowing operators to reach network segments that have no direct internet connectivity and to execute commands on them. This makes it exceptionally difficult to identify with conventional network monitoring.

Backdoor.Stupig is a newly documented DLL backdoor (February 2013 compile timestamp), first seen on 2026-05-28 as a.dll in the Windows directory and on 2026-06-01 as kbdus1.dll in System32, masquerading as the legitimate U.S. English keyboard layout kbdus.dll. It persists by registering as a keyboard-layout provider so that win32k.sys loads it into winlogon.exe at system startup; Symantec describes this as a technique not documented in any known malware family. The DLL returns a valid KBDTABLES pointer so the keyboard layout continues to function normally. Inside winlogon.exe it monitors the logon screen for usernames beginning with the string 'stupig' and executes the following text as commands with SYSTEM privileges from the secure desktop (Winsta0\Winlogon), before any user signs in and without raising anomalous audit events beyond failed-logon entries. It installs inline hooks on SspiCli!LsaLogonUser and Advapi32!CredUnprotectA (using VirtualProtect, ZwAllocateVirtualMemory and memcpy) and references a companion payload via LoadLibraryA('msyun.dll'), which was not recovered.

Symantec found no code-level overlap between Daxin and Stupig; the link rests on deployment on the same host, complementary functionality and matching 2013 compile timestamps. No C2 IPs or domains, CVEs or registry values were published, so network-IOC correlation (BeaconBeagle) returned nothing. Symantec detects the activity as Backdoor.Daxin and Backdoor.Stupig.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL
- T1014 Rootkit
- T1553.002 Subvert Trust Controls: Code Signing
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1059 Command and Scripting Interpreter
- T1056 Input Capture
- T1205 Traffic Signaling
- T1573 Encrypted Channel
- T1090.001 Proxy: Internal Proxy

## Sources

- [Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor](https://www.security.com/threat-intelligence/daxin-returns-stupig)
- [Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor (The Hacker News)](https://thehackernews.com/2026/07/daxin-resurfaces-in-taiwan-alongside.html)
- [Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network (Security Affairs)](https://securityaffairs.com/195577/malware/daxin-13-year-old-china-linked-malware-found-still-active-on-manufacturers-network.html)
- [Stupig Windows Backdoor Opens SYSTEM Shell From Login Screen (VPNCentral)](https://vpncentral.com/stupig-windows-backdoor-opens-system-shell-from-login-screen/)
- [Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade-Long Silence (SecureBlink)](https://www.secureblink.com/threat-feeds/daxin-malware-resurfaces-in-taiwan-alongside-novel-stupig-backdoor-after-decade-long-silence)
- [Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor (Aviatrix Threat Research Center)](https://aviatrix.ai/threat-research-center/daxin-resurfaces-in-taiwan-alongside-stupig-pre-login-system-backdoor/)
- [China-linked Daxin malware targeted governments (The Hacker News, 2022)](https://thehackernews.com/2022/03/china-linked-daxin-malware-targeted.html)
- [China-linked APT used Daxin, one of the most sophisticated backdoor ever seen (Security Affairs, 2022)](https://securityaffairs.com/posts/daxin-backdoor)
- [Newly Discovered Malware Evades Detection by Hijacking Communications (eSecurity Planet)](https://www.esecurityplanet.com/threats/new-malware-evades-detection/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4700