Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor
Summary: Symantec and Carbon Black found the Daxin kernel-mode rootkit, first documented in 2022 and used in targeted attacks since 2013, running on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer in 2026, alongside a previously unreported backdoor called Stupig. Both artifacts carry compilation timestamps from early 2013 even though the machine did not begin reporting telemetry until May 12, 2026, leading to suspicion the intrusion went unnoticed for 13 years; Stupig registers as a keyboard-layout provider so winlogon.exe loads it at startup and executes commands as SYSTEM from the logon screen when a username beginning with "stupig" is entered.
What you should know: A backdoor that runs as SYSTEM from the Windows logon screen, before anyone signs in and without raising a logon audit event, sits in a place most defenders are not watching, and the 2013 compile timestamps suggest it may have gone undetected for 13 years. Daxin's hijacking of existing legitimate connections for encrypted command-and-control made it exceptionally difficult to find with conventional network monitoring.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026