Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor

An advanced malware, Daxin, previously attributed to a China-linked threat actor, has resurfaced in Taiwan after more than four years. The malware, a kernel-mode rootkit, was first documented by Broadcom-owned Symantec in March 2022, with evidence indicating its use in targeted attacks aimed at governments and critical infrastructure since 2013. The latest findings from Symantec and Carbon Black Threat Hunter Team show that Daxin is still operational, running on a compromised host in Taiwan in 2026, alongside a previously unreported backdoor dubbed Stupig.

“Stupig uses a technique not documented in any known malware family,” the cybersecurity arm of Broadcom stated. “A trojanized keyboard-layout DLL loaded by ‘winlogon.exe’ lets an attacker run commands as System directly from the Windows logon screen, before anyone signs in and without raising a logon audit event.” Stupig achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup. The DLL returns a valid KBDTABLES pointer so the keyboard layout functions normally, giving nothing away to any process or administrator inspecting the loaded module. Once it starts running inside ‘winlogon.exe,’ it keeps an eye out for usernames beginning with the string “stupig” in the Windows logon screen. When the username is entered, any string that follows the prefix is interpreted as a command and executed with SYSTEM privileges. If no command is entered after the prefix, it spawns a command prompt session as SYSTEM on the logon screen.

What makes the intrusion stand out is that both the artifacts carry a compilation timestamp from early 2013, although the compromised machine did not begin reporting telemetry until May 12, 2026. Given the threat actor’s ability to stay undetected for extended periods of time, it’s suspected that the attack may have gone unnoticed for 13 years. Daxin has an unusual approach to command-and-control. Rather than directly establishing outbound connections with attacker-controlled infrastructure, the Windows kernel-mode driver backdoor monitors incoming TCP traffic for specific patterns and hijacks existing legitimate connections for encrypted C2 communications so as to blend in with regular activity. It’s equipped to interact with machines that are physically disconnected from the internet.

“This made Daxin exceptionally difficult to identify with conventional network monitoring,” Broadcom noted. “The malware also supported multi-hop communications through chains of infected hosts, allowing operators to reach systems on isolated network segments.” The discovery comes as Hunt.io said it observed a suspected China-linked threat actor using Anthropic Claude Code and DeepSeek models to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S. The discovery is based on an open directory (“112.213.124[.]132”) that has been found to share identical HTTP header fingerprints with known TencShell command-and-control (C2) infrastructure. “They handled reasoning for bypass techniques, reworked exploits after failed attempts, and built the phishing pages used to harvest credentials,” the threat intelligence firm said.

“Claude Code serves as the execution engine, managing agentic tool use, bash command execution, session persistence, and task parallelization. DeepSeek-v4-pro operates as the underlying reasoning model, handling attack logic, script generation, and decision-making. In short, offensive logic is routed through a Chinese domestic LLM while leveraging Anthropic’s agentic execution infrastructure.”