Daxin Malware Resurfaces in Taiwan Alongside Previously Undocumented Stupig Backdoor
Summary
Researchers found Daxin and a previously unknown backdoor, Stupig, on a compromised Taiwanese manufacturer’s host. Stupig can run commands as SYSTEM from the Windows logon screen; a link between the tools is suspected but unconfirmed.
Key points
- Daxin, a China-linked kernel-mode backdoor first documented in 2022, was found active on a compromised host at a Taiwan-based manufacturing subsidiary in May 2026.
- Researchers also discovered Stupig, a previously undocumented backdoor deployed on the same host; a code-level connection to Daxin has not been established.
- Stupig registers as a keyboard-layout provider and loads into winlogon.exe, where specially formatted usernames can trigger commands as SYSTEM before sign-in.
- Stupig also hooks Windows logon and credential functions, enabling credential interception within winlogon.exe.
- Both malware samples have compile timestamps from early 2013, but researchers say timestamps can be edited and the intrusion’s duration is unknown; a long-term presence is considered plausible.
- An outdated Digiwin single sign-on portal using end-of-life Java versions was considered the most likely initial access vector, but this was not confirmed.
- Daxin hijacks legitimate inbound TCP connections for encrypted command-and-control and can relay commands through infected hosts, complicating detection.
Article Details
- Attack Vectors
- The most likely initial access vector was an outdated Digiwin single sign-on portal using end-of-life JDK 1.5 and 1.6 installations; the article does not confirm this as the actual entry method.
- Backdoor.Stupig persists by registering as a keyboard-layout provider, causing win32k.sys to load its DLL into winlogon.exe at startup.
- Backdoor.Stupig monitors logon-screen usernames beginning with "stupig" and executes any following string as SYSTEM; with no suffix, it opens a SYSTEM command prompt on the logon screen.
- Backdoor.Stupig hooks SspiCli!LsaLogonUser and Advapi32!CredUnprotectA to intercept credentials within winlogon.exe.
- Backdoor.Daxin monitors incoming TCP traffic and hijacks existing legitimate connections for encrypted command-and-control communications, with multi-hop relaying through infected hosts.
- Defensive Notes
- Investigate and update the outdated Digiwin single sign-on portal and its end-of-life JDK 1.5 and 1.6 installations.
- Check for the Daxin driver srt64.sys and Stupig files a.dll and kbdus1.dll, including a similarly named keyboard-layout DLL in the System32 directory.
- Review keyboard-layout provider registrations and unexpected DLL loading into winlogon.exe, including unusual logon attempts with usernames beginning with "stupig".
- Monitor for anomalous inline hooks in winlogon.exe and for credential interception involving SspiCli!LsaLogonUser and Advapi32!CredUnprotectA.
- Conventional monitoring focused on outbound connections may miss Daxin because it hijacks incoming TCP connections for C&C traffic.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530 | SHA-256 of srt64.sys, identified as Backdoor.Daxin. |
| SHA256 | 5bb5cffda4647940919a185df37aab2aef71ca3010a6c1d05bdcc8bc8fb3af3f | SHA-256 of a.dll / kbdus1.dll, identified as Backdoor.Stupig. |
MITRE ATT&CK
Malware
Backdoor.DaxinBackdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational. It was found running on a compromised host in Taiwan in 2026, more than four years after itBackdoor.StupigOn the same machine, the Symantec Threat Hunter Team discovered a previously unknown backdoor, Backdoor.Stupig, whose novel tradecraft may link it to the Daxin operation, though no code-level connection has been
Vendors
BroadcomThe Threat Hunter Team is a group of security experts within Broadcom whose mission is to investigate targeted attacks, drive enhanced protection in Symantec and Carbon Black products, and offer analysis that helpsSymantecFour years after Symantec first uncovered Daxin, the most advanced malware we had seen from a China-linked actor, it has been found running inside a Taiwan manufacturing firm, deployed with a novel new backdoor.
Products
Carbon BlackSymantec and Carbon BlackDigiwinThe most likely initial access vector was an outdated version of the Digiwin single sign-on portal, which was still using Java Development Kit (JDK) 1.5 and 1.6 installations dating from 2009 to 2011. Both JDK versionsMicrosoft Windowskeyboard-layout DLL loaded by winlogon.exe lets an attacker run commands as System directly from the Windows logon screen, before anyone signs in and without raising a logon audit event.SymantecFour years after Symantec first uncovered Daxin, the most advanced malware we had seen from a China-linked actor, it has been found running inside a Taiwan manufacturing firm, deployed with a novel new backdoor.
Countries
Industries
Governmentappear to be of strategic interest to China. Our 2022 investigation documented use of the tool against government, telecommunications, transportation, and manufacturing targets. Taiwan's advanced manufacturing baseManufacturingFour years after Symantec first uncovered Daxin, the most advanced malware we had seen from a China-linked actor, it has been found running inside a Taiwan manufacturing firm, deployed with a novel new backdoor.Telecommunicationsstrategic interest to China. Our 2022 investigation documented use of the tool against government, telecommunications, transportation, and manufacturing targets. Taiwan's advanced manufacturing base has been the focusTransportationto China. Our 2022 investigation documented use of the tool against government, telecommunications, transportation, and manufacturing targets. Taiwan's advanced manufacturing base has been the focus of sustained