Malware

Daxin

Also known as: DELIMEAT

Symantec describes this as a malware written as Windows kernel driver, used by China-linked threat actors. The malware has a custom TCP/IP stack and is capable of hijacking connections.

Indicators of Compromise 4

Filename a.dll Filename kbdus1.dll Filename srt64.sys IP 112[.]213[.]124[.]132

MITRE ATT&CK TTPs 5

T1055
Process Injection
Defense Evasion
 T1078
Valid Accounts
Defense Evasion
 T1098
Account Manipulation
Persistence
 T1543.003
Windows Service
Persistence
 T1566
Phishing
Initial Access

Source Articles

Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor
A China-linked threat actor has resurfaced with the Daxin kernel-mode rootkit, detected in 2026 within a Taiwan-based subsidiary of a multinational high-tech manufacturer. The compromised system was also infected with a previously undocumented backdoor, Stupig, which enables pre-login SYSTEM-level command execution by masquerading as a legitimate keyboard DLL. Both malware samples were compiled in 2013, suggesting long-term stealthy persistence, with Daxin using covert C2 via hijacked TCP connections and Stupig enabling credential theft before user login. The attack highlights sophisticated, sustained cyber espionage activity targeting critical infrastructure.
hacker-news ·1w ago