Researchers have identified the China-linked Daxin rootkit and a previously unknown backdoor, dubbed Stupig, active on the network of a Taiwan-based subsidiary of a multinational high-tech manufacturer. The discovery suggests a highly stealthy intrusion that may have persisted undetected for 13 years, with compilation timestamps on both malware artifacts dating back to early 2013.
Symantec's Threat Hunter Team found Daxin operating on a compromised host in 2026. Daxin, a Windows kernel-mode rootkit first documented by Symantec in March 2022, has been associated with targeted attacks against government entities and critical infrastructure since 2013. The presence of Daxin on the network in 2026, more than four years after its initial public exposure, indicates its continued operational use.
The same compromised machine also harbored the Stupig backdoor. While neither Daxin nor Stupig are newly developed tools, their continued activity and apparent lack of detection for over a decade highlight their sophisticated evasion techniques. Telemetry from the affected machine only began appearing in May 2026, implying the long duration of the compromise.
Daxin is implemented as a Windows kernel driver, an uncommon approach for malware. It possesses advanced communication capabilities designed to operate within highly secured networks lacking direct internet connectivity. The malware conceals its traffic by monitoring incoming TCP traffic for specific patterns and hijacking existing legitimate connections to conduct encrypted command-and-control (C2) communications. This method allows Daxin to blend with normal network traffic, making it exceptionally difficult to detect with conventional network monitoring that typically looks for suspicious outbound connections. Its multi-hop capability enables attackers to reach machines without direct internet access by routing commands through a chain of compromised devices.
Stupig, a DLL backdoor, achieves persistence by registering itself as a keyboard-layout provider, mimicking the legitimate kbdus.dll file used for the U.S. English keyboard layout. This causes win32k.sys to load it into winlogon.exe at system startup. The DLL returns a valid KBDTABLES pointer, ensuring normal keyboard functionality and avoiding suspicion from processes or administrators inspecting loaded modules.
Once running within winlogon.exe, Stupig monitors the Windows login screen for usernames beginning with the string "stupig." Any characters following this prefix are interpreted as commands and executed with SYSTEM privileges, the highest level of access on a Windows system. If the prefix is typed without any subsequent characters, the backdoor opens a command prompt with SYSTEM privileges directly on the login screen, prior to user authentication. This technique, not previously documented in known malware families, allows attackers to run commands as System from the logon screen without generating a logon audit event, effectively bypassing authentication logs.
While Symantec has not found code-level overlap between Daxin and Stupig, preventing a definitive link to the same development team, their deployment on the same host, complementary functions, similar development practices, and identical 2013 compile timestamps suggest a connection. Daxin handles deep network persistence and covert communications, while Stupig provides pre-authentication SYSTEM access through a mechanism not typically monitored by security teams. If attributed to the same actor, Stupig would offer an additional capability for SYSTEM-level command execution and credential theft.
The initial compromise vector for the host remains undetermined. However, researchers suggest a likely entry point was an outdated version of the Digiwin single sign-on portal, which was running end-of-life Java Development Kit versions 1.5 and 1.6, software released between 2009 and 2011. This represents a significant exposed attack surface on the network of a subsidiary of a multinational manufacturer.
