Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor

Symantec's Threat Hunter Team discovered the China-linked kernel-mode rootkit Backdoor.Daxin active on a compromised host in Taiwan in May 2026, more than four years after its initial public disclosure. Alongside Daxin, a previously undocumented backdoor, Backdoor.Stupig, was found deployed on the same system. Stupig enables pre-authentication command execution as SYSTEM via a Trojanized keyboard-layout DLL loaded by winlogon.exe, bypassing logon audit events. Both malware samples carry compile timestamps from early 2013, suggesting a potential long-term undetected compromise lasting over a decade, possibly facilitated through an outdated Digiwin single sign-on portal with legacy Java components.

AI-extracted · verify before operational use