Daxin Rootkit Resurfaces in Taiwan Alongside Novel Stupig Pre-Logon Backdoor

An advanced malware previously attributed to a China-linked threat actor has resurfaced after more than four years within a Taiwan manufacturing firm, along with a previously unreported backdoor dubbed Stupig. Daxin (“srt64.sys”), a kernel-mode rootkit first documented by Broadcom-owned Symantec in March 2022, has been used in targeted attacks against governments and critical infrastructure since 2013. The latest findings from Symantec and Carbon Black Threat Hunter Team show Daxin still operational on a compromised host in Taiwan in 2026.

The same machine, belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer, was also infected with Stupig (“a.dll” or “kbdus1.dll”), masquerading as a legitimate Microsoft DLL. Stupig uses a novel technique: a trojanized keyboard-layout DLL loaded by winlogon.exe allows attackers to run commands as SYSTEM directly from the Windows logon screen before anyone signs in, without raising a logon audit event.

Both artifacts carry a compilation timestamp from early 2013, though the compromised machine did not report telemetry until May 12, 2026. This suggests the attack may have gone undetected for 13 years. Daxin monitors incoming TCP traffic for specific patterns and hijacks existing legitimate connections for encrypted C2 communications, making it exceptionally difficult to identify with conventional network monitoring. It also supports multi-hop communications through chains of infected hosts.

Exactly how the host was compromised remains unknown, but it is suspected to involve an outdated version of the Digiwin single sign-on (SSO) portal using end-of-life Java Development Kit (JDK) 1.5 and 1.6 installations. Stupig achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup. It monitors for usernames beginning with “stupig” and executes commands with SYSTEM privileges.

The disclosure also notes that Hunt.io observed a suspected China-linked threat actor using Anthropic Claude Code and DeepSeek models to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S., sharing identical HTTP header fingerprints with known TencShell C2 infrastructure.