Daxin, a sophisticated kernel-mode rootkit linked to China-based espionage actors, has resurfaced on systems in Taiwan after more than four years of no public activity. Researchers at Symantec discovered the malware running on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer in May 2026, revealing it remained operational decades after its first known deployment in 2013.
What sets this reemergence apart is the discovery of Stupig, a previously undocumented keyboard-layout backdoor deployed alongside Daxin. The two malware samples carried compile timestamps from January and February 2013, indicating coordinated development by the same threat actor. Together, they reveal a persistence capability that remained undetected for approximately 13 years.
Table of Contents
- How Daxin and Stupig Work Together
- Credential Theft and Command Execution
- How Long Was the System Compromised?
- Why Outdated Software Enabled the Attack
- What Organizations Should Do Now
- Frequently Asked Questions
How Daxin and Stupig Work Together
Daxin operates as a signed kernel-mode Windows driver (srt64.sys) that monitors TCP traffic and hijacks legitimate connections to hide encrypted command-and-control communications from network monitoring. This kernel-level access allows it to intercept traffic before security tools can see it, making it extremely difficult to detect through normal network monitoring. Stupig takes a different approach to maintain persistence and gather credentials.
The backdoor registers a trojanized DLL (kbdus1.dll) as a keyboard-layout component, gaining execution within winlogon.exe before any user logs in and avoiding standard audit events. At the login screen, Stupig monitors for usernames prefixed with "stupig," executing any following text as SYSTEM-level commands while appearing as a failed login attempt. This allows attackers to run arbitrary commands with the highest privileges on the system without leaving obvious traces.
Credential Theft and Command Execution
Beyond command execution, Stupig also steals login credentials. The malware hooks Windows credential protection functions (SspiCli!LsaLogonUser and Advapi32!CredUnprotectA), enabling interception and theft of logon credentials at the winlogon.exe level before any user authentication.
With these credentials, attackers can move laterally across the network and maintain access through legitimate user accounts. The combination of kernel-level traffic manipulation and user-level credential theft creates a layered persistence mechanism. An attacker with both tools can hide their command-and-control communications and impersonate legitimate users, making the intrusion nearly invisible to defenders monitoring either network traffic or user activities alone.
How Long Was the System Compromised?
The malware's compile timestamps and lack of earlier detection suggest the intrusion persisted for approximately 13 years. The Daxin samples discovered in Taiwan were virtually identical to the 2022 version, indicating minimal changes to the core malware over a decade, yet detection only occurred in May 2026.
This extended dwell time is consistent with the threat actor's documented tradecraft of long-term espionage campaigns. Rather than launching disruptive attacks, the actors maintained quiet access to sensitive systems, likely to gather intelligence on technology development and manufacturing processes at the target organization.
Why Outdated Software Enabled the Attack
Initial access to the compromised Taiwan manufacturer is suspected to have exploited an outdated Digiwin single sign-on portal still running Java Development Kit 1.5 and 1.6—both long past end-of-life—installations from 2009–2011. These Java versions had not received security patches for over a decade when the malware was discovered.
This vulnerability illustrates a critical gap in enterprise security: critical infrastructure and legacy systems often run software so old that patching is difficult or impossible without major replacement. Organizations managing sensitive manufacturing or technology development may assume that air-gapping or internal-network placement provides protection, but outdated authentication portals can serve as a foot-hold for persistent espionage.
What Organizations Should Do Now
Organizations should immediately inventory their systems for outdated Java versions, particularly on authentication and single sign-on infrastructure. If Java 1.5, 1.6, 1.7, or other long-obsolete versions are in use, replacement or retirement should become an urgent priority rather than a deferred upgrade.
Monitor for suspicious login attempts using usernames like "stupig" or unusual SYSTEM-level process executions originating from winlogon.exe. Enable kernel-mode driver auditing and network traffic inspection for hidden command-and-control tunneling. Most critically, treat legacy software as a security liability equal to unpatched network-facing services—the difference between them is often only visibility, not actual risk.
Frequently Asked Questions
Is Daxin likely targeting my organization?
Daxin has been linked to China-based espionage campaigns targeting high-tech manufacturers and companies with sensitive intellectual property. If your organization manufactures semiconductors, electronics, or develops proprietary technology, your risk is elevated. However, the malware requires initial access through vulnerable legacy systems—organizations with current software and patch management are significantly less exposed.
How would I know if Daxin was on my network?
Daxin's kernel-mode driver and Stupig's credential hooks are designed to avoid detection by endpoint security tools. However, behavioral indicators include unexpected SYSTEM-level processes from winlogon.exe, unusual device driver loading, and network traffic patterns consistent with traffic hijacking. Kernel-mode audit logging and behavioral network analysis offer the best detection chances.
What should I do about systems I cannot update?
Isolate systems running obsolete software (Java 1.5, 1.6, or other decades-old versions) from direct network access where possible. Place them behind application firewalls with strict allow-lists, segment them from networks containing sensitive data, and monitor them intensively for signs of compromise. Consider whether these systems are essential or candidates for replacement.