【CyCraft Monthly Intelligence】The Return of Daxin: Stealthy Malware Resurfaces in Taiwan with a New Backdoor

‍

Threat and Impact

Backdoor.Daxin has resurfaced in Taiwan, highlighting that highly capable, China-linkedespionage actors continue to threaten Taiwan's strategically importantorganizations. Four years after Symantec publicly disclosed Daxin, researchersdiscovered in May 2026 that the malware was still active on a compromised hostbelonging to a Taiwanese subsidiary of a multinational high-tech manufacturer.This finding indicates that the operations behind Daxin did not disappearfollowing public exposure; rather, they likely maintained a low profile,persistent, and remained operational.

Daxin is noordinary commercial malware; it is a Windows kernel-mode backdoor designed forlong-term stealth and espionage operations. Instead of connecting to C2 serversin a traditional manner, it hides its communications within legitimate inboundTCP connections. This makes standard network monitoring difficult to identifythe malware, especially in environments where defenders primarily look forsuspicious outbound beaconing traffic. Daxin also supports multi-hopcommunication chained across multiple infected hosts, enabling attackers toreach systems that may be isolated from the Internet or protected by networksegmentation.

In thisincident, researchers also discovered a previously undocumented backdoor namedBackdoor.Stupig on the same host where Daxin was found. While it has not beenconfirmed whether the two malware families share a direct code-levelconnection, their presence on the same host, similar development timelines,complementary capabilities, and shared operational characteristics suggest apotential operational link between them. Stupig further escalates the risk byabusing the Windows logon process. Masquerading as a keyboard layout DLL andloading into winlogon.exe, it allows attackers to executecommands with SYSTEM privileges directly from the Windows logon screen beforeany user logs in. It also possesses the capability to intercept credentials,increasing the potential for privilege escalation and lateral movement.

The potentialduration of the compromise represents one of the most serious aspects of thiscase. Compilation timestamps for both Daxin and Stupig date back to early 2013,yet the compromised host only began transmitting telemetry data in May 2026.Although timestamps can be modified and legacy malware can be deployed yearsafter creation, the combination of the malware's age, the absence of earlytelemetry, and Daxin's known focus on long-term persistent access suggests thatthe intrusion may have gone undetected for years—potentially up to 13 years.

The most likelyinitial access vector was an outdated Digiwin single sign-on (SSO) portalrunning deprecated Java Development Kit (JDK) versions 1.5 and 1.6. Theseversions have been end-of-life for over a decade, making them highly attractivetargets for advanced actors seeking reliable entry into enterprise environments.This underscores a common vulnerability in industrial and manufacturingnetworks: legacy business systems often remain operational long after theunderlying software has reached the end of its lifecycle.

Even withoutimmediate reports of financial losses or public service disruptions, intrusionsof this nature can carry severe consequences. Long-term access to manufacturingnetworks may allow attackers to acquire sensitive business information,intellectual property, production data, credentials, vendor relationships, andinternal network architecture. In a multinational corporate environment, acompromised subsidiary can also serve as a foothold for attackers to gainfurther access to the broader corporate infrastructure or partner networks.

This event alsodemonstrates that the public disclosure of advanced malware families does notguarantee the cessation of their operations. Well-resourced threat actors arelikely to continue using known tools as long as they remaineffective—particularly in environments with incomplete monitoring, legacysystems, or insufficient visibility. For defenders, the reappearance of Daxinserves as a warning: long-term stealth intrusions can lurk in critical networksfor years before emerging through improved telemetry capabilities or thedetection of specific artifacts.

Overall, thisincident highlights the strategic cyber risks facing Taiwan's high-techindustry and other geopolitically significant sectors. Organizations inmanufacturing, critical infrastructure, government services, and global supplychains should view this case as evidence that advanced espionage actorscontinue to prioritize long-term access, stealthy C2, and credential-focusedbackdoors over high-profile, short-lived attacks.

Analyst Perspective

While thedirect victim of this incident was a high-tech manufacturing organizationlocated in Taiwan, the broader implications extend beyond a single enterprise.Historical Daxin activity has involved attacks targeting government,telecommunications, transportation, and manufacturing sectors—industries thathold strategic intelligence value. Taiwan's advanced manufacturing industryplays a pivotal role in global technology supply chains, making itexceptionally critical and a continuous target for state-sponsored cyberoperations.

For industriessuch as high-tech manufacturing, telecommunications, transportation, andgovernment, the primary risk is not merely malware infection, but silent,strategic intrusions. Daxin's covert communication methods and Stupig'spre-authentication access capabilities provide attackers with the tools tomaintain access, steal credentials, move laterally, and reach sensitive networksegments. These capabilities align far more closely with espionage objectivesthan with short-term criminal activities.

Technical Details

This incidentinvolves the re-emergence of Backdoor.Daxin—a highly stealthy, China-linkedWindows kernel-mode backdoor—discovered on a compromised host within aTaiwanese subsidiary of a multinational high-tech manufacturer. Researchersalso identified a previously undocumented DLL backdoor, named Backdoor.Stupig,on the same system. The two tools offer complementary capabilities: Daxinachieves stealthy C2 by hijacking legitimate network connections, while Stupigabuses the Windows logon process to provide local, pre-authenticationSYSTEM-level command execution and credential interception capabilities.

The likely rootcause was an internet-facing, outdated Digiwin SSO portal running deprecatedJDK 1.5 and JDK 1.6 installations dating from 2009 to 2011. These Java versionshave been unsupported for many years and likely served as the entry point forthe intrusion. Once inside the environment, the attackers deployed malwaredesigned to blend into Windows core components, evade standard monitoring, andmaintain long-term access. Compilation timestamps for both malware samples dateback to early 2013, whereas the affected host only began transmitting telemetryin May 2026, indicating that the intrusion may have persisted undetected foryears.

Resource Development

The attackers utilized two custom malware capabilities: Backdoor.Daxin and Backdoor.Stupig.

• Backdoor.Daxin
  • Daxin is a Windows kernel-mode driver backdoor/rootkit. The fileidentified in this incident is:
    
    • %SystemRoot%\System32\drivers\srt64.sys
  • Its SHA-256 hash is:
    • 49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530
  • The drivercarries a digital signature, which helps it pass Windows Driver SignatureEnforcement checks. Its compilation and signing timestamps both point toJanuary 2013, and the sample is identical to the Daxin variants previouslydocumented by Symantec.
  • Daxin's corecapability is stealthy C2. Instead of initiating standard outbound connectionsto an attacker-controlled C2 server, it monitors inbound TCP traffic forspecific patterns and hijacks legitimate connections to transmit encryptedcommand traffic. This makes the malware difficult to detect using traditionalnetwork monitoring methods focused on outbound beaconing.

• Backdoor.Stupig
  • Stupig is a previously unknown DLL backdoor discovered on the samecompromised host.
  • It appeared under two names:
    
    • %SystemRoot%\a.dll
    • %SystemRoot%\System32\kbdus1.dll
  • Its SHA-256 hash is:
    • 5bb5cffda4647940919a185df37aab2aef71ca3010a6c1d05bdcc8bc8fb3af3f
  • The later filename, kbdus1.dll, intentionally mimicsthe legitimate Windows US English keyboard layout DLL:
    • %SystemRoot%\System32\kbdus.dll
  • Stupig'scompilation timestamp dates to February 2013—just weeks after Daxin'stimestamp. Although a direct code-level link between the two tools has not beenconfirmed, their co-deployment, similar development timeframes, andcomplementary capabilities suggest they were likely operated by the same threatactor.

Initial Access

The most probable initial access vector was an outdated Digiwin SSOportal.

The portal was running legacy Java versions:

• JDK 1.5
• JDK 1.6

These versionswere installed between 2009 and 2011 and have been unsupported for years. JDK1.5 reached end-of-life in 2009, and JDK 1.6 in 2013. While the original reportdoes not specify a particular CVE or exploit method, running unsupported Javaversions on an SSO portal presents a high-risk posture. Such systems frequentlycontain unpatched vulnerabilities and can expose authentication infrastructureto attackers.

This vector likelyprovided the initial foothold from which the attackers subsequently deployedDaxin and Stupig.

Execution

The attackers executed code through both kernel-level and user-modemechanisms.

• Daxin Kernel-Mode Execution
  • Daxin operatesas a kernel-mode driver:
    • srt64.sys
  • By executing in kernel mode, Daxin gains deep access to the operatingsystem and network stack. This allows it to monitor TCP traffic at a low leveland interfere with legitimate network connections without relying on typicaluser-mode malware behavior.

• Stupig executes by abusing the Windows keyboard layout loadingmechanism. It registers itself as a keyboard layout provider, causing Windowsto load the malicious DLL into:
  • winlogon.exe
• The loadingprocess involves win32k.sys, which loads keyboard layoutDLLs into the Windows logon process. Once loaded, Stupig returns a valid KBDTABLESpointer, allowing the keyboard layout to continuefunctioning normally. This helps the malware avoid generating obviousindicators of compromise.
• Its mostdistinct execution capability is triggered directly from the Windows logonscreen. Stupig monitors username inputs at the logon interface. If the usernamebegins with the string:
  • stupig
• Any text following this prefix is executed as a command with SYSTEMprivileges. For example, conceptually:
  • stupig<command>
• This will cause the command portion to execute with SYSTEMrights.
• If only theprefix is entered without a trailing command, Stupig spawns a command promptwith SYSTEM privileges directly on the Windows logon screen. This allowsattackers to execute commands prior to a legitimate user logging in, bypassingthe need for a standard authenticated session.

Persistence

Both malwarefamilies are engineered for long-term persistent access.

• Daxin Driver Persistence
  • Daxin maintains persistence as a Windows kernel driver installed in thesystem drivers directory:
    
    • %SystemRoot%\System32\drivers\srt64.sys
  • Because the driver is digitally signed, it bypasses Windows DriverSignature Enforcement more readily than unsigned drivers. Installing as adriver also allows it to start alongside the OS and continuously operate athigh privilege levels.

• StupigKeyboardLayout Persistence
  • Stupig maintains persistence in a novel manner by registering itself asa keyboard layout DLL. Keyboard layout providers are typically legitimateWindows DLLs used to support language and keyboard input. Stupig abuses thismechanism to ensure it is loaded intowinlogon.exeat system startup.
  • This persistence method likely involves the registry key location:
    • HKLM\SYSTEM\CurrentControlSet\Control\KeyboardLayouts\...\Layout File
  • The malicious Layout File points to anattacker-controlled DLL, such as:
    • kbdus1.dll
  • While thistechnique falls under the broader category of Winlogon Helper DLL persistence,it utilizes a different registry load path than those commonly documented inpublic malware analysis.
  • Once loadedinto winlogon.exe, Stupig maintains persistencewithin one of the most trusted Windows processes. Because the DLL behaves likea valid keyboard layout provider and returns correct KBDTABLES pointers, system operationsremain completely normal from the user's perspective.

• Back-up or Adjusted Persistence
  • When Stupig wasfirst detected, its filename was:
    • a.dll
  • Followingdetection, a renamed version appeared in the System32 directory:
    • kbdus1.dll
  • This change mayrepresent an operational security adjustment following initial detection.Alternatively, the renamed copy may have existed as a redundant backdoor thatwas discovered at a later stage.
  • The namekbdus1.dlldiffers by only a single character from the legitimatekbdus.dll, likely intended toevade casual inspection and bypass simple filename-based detection rules.

Privilege Escalation

Stupig achievesdirect privilege escalation by executing attacker-supplied commands as SYSTEM from the Windows logon screen.

This privilegeescalation is possible because Stupig runs within:

• winlogon.exe

winlogon.exe operates in a highly privilegedcontext and activates before user authentication. By inserting itself into thisprocess via the keyboard layout mechanism, Stupig inherits the ability toexecute code in a high-privilege environment.
Attackers do not need a successful login; entering a username starting with stupig triggers Stupig to execute theremaining string as a SYSTEM-level command. If no command follows, it spawns aSYSTEM command prompt on the secure desktop: Winsta0\Winlogon
This grantsattackers top-tier local administrative control over the host, eitherinteractively or via command-line interface.

Defense Evasion

Both malware components in this incident utilize multiple defenseevasion techniques.

• Daxin's Defense Evasion
  • Daxin evades detection through the following design choices:
    1. Kernel-Mode Operation: Running as a kernel driver allows Daxin to operate beneath many user-mode security tools and interact directly with network traffic.
    2. Digitally Signed Driver: The srt64.sys driver is signed, helping it pass Windows Driver Signature Enforcement checks and appear legitimate.
    3. No Traditional Outbound C2 Beacons: Daxin avoids initiating obvious outbound C2 connections, choosing instead to passively monitor inbound TCP traffic and hijack legitimate sessions.
    4. Encrypted C2 Hidden in Legitimate Traffic: Command traffic is encrypted and transmitted over network connections that appear normal at the traffic level.
    5. Multi-Hop Relay Capability: Daxin can relay traffic through a chain of infected hosts, obscuring the operator's actual connection path.

• Stupig’s Defense Evasion
  • Stupig also employs several stealth mechanisms:
    1. Masquerading as a Keyboard Layout DLL: The renamed kbdus1.dll closely mirrors the legitimate Windows file kbdus.dll.
    2. Placement in Trusted Directories: The malware resides within standard Windows directories, including System32, which routinely host legitimate system DLLs.
    3. Execution within winlogon.exe: Stupig loads inside winlogon.exe, hiding within a trusted Windows process.
    4. Preservation of Normal Keyboard Behavior: Stupig returns valid KBDTABLES pointers to keep keyboard functionality normal, preventing obvious client-side anomalies.
    5. Minimal Audit Footprint: After processing the attacker's trigger input, Stupig passes control back to the genuine LsaLogonUser function. As a result, Windows merely logs a standard failed logon attempt for the unusual username, leaving no explicit audit trail indicating successful unauthorized execution.
    6. Filename-Based Evasion: Transitioning from a.dll to kbdus1.dll suggests an attempt to bypass detection rules or analyst scrutiny targeting the original filename.

Credential Access

Stupig incorporates credential interception capabilities within the Windows logon process.

It installs inline hooks on two functions:

• SspiCli!LsaLogonUser
• Advapi32!CredUnprotectA

These functions are integral to authentication and credential processing. By hooking them inside winlogon.exe, Stupig can intercept sensitive authentication data immediately before or during the logon sequence.

The hooks are installed using memory modification techniques involving the following functions:

• VirtualProtect
• ZwAllocateVirtualMemory
• memcpy

This allows the malware to modify in-memory code execution paths and redirect control flow to its own logic.

Operating inside winlogon.exe grants Stupig visibility into credentials at a critical moment during user authentication. The original report also notes that Stupig references:

• LoadLibraryA("msyun.dll")

This indicates a potential associated payload, though msyun.dll was not recovered during the investigation.

‍Lateral Movement

Daxin performs lateral movement via its multi-hopcommunication capability.

Daxin does notrequire every infected host to communicate directly with the attacker; instead,it can relay commands across a chain of compromised systems. This enablesoperators to navigate the target environment and reach systems located inisolated or restricted network segments.

This capabilityis particularly vital in environments where sensitive manufacturing,engineering, or operational systems lack direct Internet access. By usingcompromised hosts as relay nodes, attackers can maintain control across networkboundaries while avoiding outbound connections from the most sensitive internalsystems.

In practice,one compromised host acts as a bridge to another, which in turn relays trafficdeeper into the network, forming an attacker-controlled internal proxy chain.

Collection

The most explicit data collection activity identified isStupig's credential interception functionality.

By hooking LsaLogonUser and CredUnprotectA, Stupig collectsauthentication-related data directly within winlogon.exe. Credentials harvested in this manner can be leveraged for deepernetwork access, privilege abuse, persistence maintenance, or lateral movement.

While thesource material does not detail the exfiltration of documents, intellectualproperty, or manufacturing data, the victim's profile as a Taiwanese subsidiaryof a high-tech manufacturer suggests the environment contains high-valuestrategic information. However, the technical collection capability confirmedin this incident remains Stupig's credential sniffing mechanism.

Command and Control (C2)

Daxin 的指揮與控制設計，是本次事件中最具技術意義的部分之一。

Daxin's command-and-control design represents one of the mosttechnically significant aspects of this incident.

Whereas mostbackdoors establish outbound connections to attacker-controlled infrastructure,Daxin avoids this model. It operates passively as a kernel-mode driver,monitoring incoming TCP traffic for specific sequence signatures. When amatching pattern is detected, Daxin hijacks the legitimate TCP connection anduses it to carry encrypted C2 traffic.

This presentsseveral significant hurdles for security monitoring:

• Absence of obvious outbound traffic.
• Network traffic appears to belong to legitimate services.
• Network sensors observe standard inbound TCP sessions.
• Malicious payloads remain encrypted.
• Attackers can route traffic through internal relay chains without directly connecting to every infected host.

Daxin's multi-hop capability further enhances C2 stealth. Compromised internal hosts serve as intermediate jump points, allowing operators to reach isolated network segments without exposing those internal systems directly to external infrastructure.

Stupig provides a complementary local access mechanism. Operators with console access or equivalent interactive privileges can enter crafted usernames at the logon screen to execute SYSTEM-level commands without completing a valid login. This functionality complements Daxin's network-level C2, providing an alternative route for regaining or maintaining elevated host access.

Complete Attack Flow

Based onavailable evidence, the technical workflow proceeded as follows:

1. The attackers gained initial access, most likely by exploiting an outdated Digiwin SSO portal running deprecated JDK 1.5 / 1.6 software.
2. Daxin was installed as a signed kernel-mode driver named srt64.sys located in %SystemRoot%\System32\drivers.
3. Daxin hijacked legitimate inbound TCP connections to transmit encrypted command traffic, establishing a stealthy C2 channel.
4. Stupig was deployed as a DLL, initially observed as a.dll and later renamed to kbdus1.dll.
5. Stupig registered itself as a keyboard layout provider, ensuring it loaded into winlogon.exe at system startup.
6. Embedded inside winlogon.exe, Stupig monitored the logon screen for usernames starting with the prefix stupig.
7. Attackers triggered pre-authentication command execution as SYSTEM or spawned a SYSTEM command prompt directly from the logon screen.
8. Stupig hooked authentication functions (LsaLogonUser, CredUnprotectA) to capture credentials in memory.
9. Daxin's multi-hop capability enabled operators to relay commands across compromised hosts to reach isolated internal networks.
10. The combined deployment leveraged signed drivers, trusted process injection, disguised filenames, legitimate-looking logon failure logs, and an absence of traditional outbound C2 beacons to maintain high operational stealth.

The pairing ofDaxin and Stupig illustrates an advanced intrusion focused on stealth,persistence, high-privilege access, and covert control—with Daxin handlingremote network C2 and Stupig securing local SYSTEM execution and credentialharvesting at the Windows logon boundary.

Mitigation

Responding to an incident involving Daxin and Stupig requires more thanjust removing known files. Both tools were engineered for long-term stealth:Daxin conceals command-and-control (C2) traffic within legitimate TCPconnections, while Stupig abuses the Windows keyboard layout loading mechanismto execute inside winlogon.exe prior to user authentication.Consequently, organizations should adopt an approach that combines immediatecontainment, enterprise-wide threat hunting, legacy system remediation, andlong-term monitoring enhancements.

• First, organizations should update their endpoint protection and detection rules. Symantec products detect these malware variants as Backdoor.Daxin and Backdoor.Stupig. Defenders should verify that antivirus signatures, EDR sensors, and malware definitions across all servers and workstations are fully up to date. Published indicators of compromise (IOCs) should be used to search for known samples across the environment.
• Defenders should also search for the following file paths:
  • %SystemRoot%\System32\drivers\srt64.sys
  • %SystemRoot%\a.dll
  • %SystemRoot%\System32\kbdus1.dll
• However, matching IOCs alone is insufficient. Stupig transitioned from a.dll to kbdus1.dll to intentionally mimic kbdus.dll, the legitimate Windows keyboard layout library. Organizations should therefore look for suspicious "typosquatted" or lookalike DLLs—specifically keyboard layout files with names closely resembling legitimate Microsoft files, abnormal timestamps, lack of a Microsoft digital signature, or location in unusual directories.
• In this incident, the most likely initial access vector was an outdated Digiwin single sign-on (SSO) portal running Java Development Kit (JDK) versions 1.5 and 1.6. These JDK versions have been end-of-life for years and must not remain in production environments. Organizations utilizing Digiwin SSO or similar legacy Java-based authentication portals should immediately audit these systems, identify deprecated JDK/JRE installations, and upgrade, isolate, or decommission them. If an application cannot be upgraded immediately, it should be placed behind strict access controls, closely monitored, and segmented from sensitive internal networks.
• Attention must also be directed toward Windows persistence mechanisms. Stupig registers itself as a keyboard layout provider, forcing Windows to load the malicious DLL into winlogon.exe at system startup. Defenders should inspect keyboard layout registry settings, specifically:
• HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\*\Layout File
• These entries should be compared against a known-good baseline. Any keyboard layout DLL that is unsigned, lacks a Microsoft signature, was created outside of regular patching windows, or visually mimics a legitimate file warrants further investigation. Because Stupig executes within winlogon.exe, organizations should monitor for abnormal modules loaded by winlogon.exe as well as any child processes it spawns—such as cmd.exe, powershell.exe, rundll32.exe, or scripting tools. Any command prompt or SYSTEM-level process spawned from the Windows logon screen should be treated as highly suspicious.
• Organizations should also strengthen authentication monitoring. Stupig triggers command execution from the Windows logon screen using usernames prefixed with stupig. Because failed authentication attempts may appear as ordinary logon failures, defenders should not ignore unusual account names in logon failure logs. Security teams should query Windows security event logs for failed logons featuring strange usernames—particularly those beginning with stupig—and establish detection rules targeting anomalous pre-authentication activity.
• If Daxin or Stupig is suspected, incident responders should preserve forensic evidence prior to rebooting systems or deleting files. Memory acquisition is especially critical because Daxin operates in kernel mode while Stupig alters in-memory execution within winlogon.exe. Once evidence collection is complete, affected hosts should be isolated from the network, followed by the collection of disk images, registry hives, driver metadata, Windows event logs, EDR telemetry, and network traffic records. Given that the intrusion may have persisted undetected for years, the scope of the investigation should include historical log reviews, credential usage analysis, lateral movement tracking, and auditing other hosts that lack telemetry or recently resumed telemetry reporting.
• While the original report does not reference specific patches, the most effective mitigation strategy is a layered approach: remove or upgrade legacy SSO and Java components, deploy updated malware detections, hunt for both static and behavioral indicators, monitor abused Windows configurations (such as keyboard layout registry keys and kernel drivers), and assume that any confirmed infection represents a long-term intrusion requiring a full incident response process rather than simple file deletion.

Indicator of Compromise (IoCs)

Files

‍

References

• Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
• China-linked Actors Maintain Focus on Organizations Influencing U.S. Policy
• Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence
• CVE-2026-5964: EasyFlow .NET SQL Injection Vulnerability
• 'Most advanced’ China-linked backdoor ever, Daxin, raises alarms for cyber-espionage investigators

‍