Teams from Symantec and the Carbon Black Threat Hunter Team have discovered an active instance of the Daxin rootkit on a compromised host belonging to the Taiwanese subsidiary of a multinational high-tech manufacturer. On the same host, they identified a previously unknown backdoor, Stupig, which uses a non-trivial persistence mechanism by substituting the Windows keyboard layout DLL. Both samples carry compilation timestamps dating back to early 2013, while telemetry from the infected machine only began arriving on 12 May 2026 — raising the question of a potentially years-long undetected presence of the adversary in the network. Organizations using outdated software versions and JDK in production environments should audit for similar indicators of compromise.
Technical characteristics of Daxin
Daxin (srt64.sys) is a Windows kernel-mode driver, first publicly documented by Symantec in March 2022. According to researchers, evidence of its use in targeted attacks against government entities and critical infrastructure can be traced back to 2013.
The key architectural feature of Daxin is its avoidance of direct outbound connections to command-and-control infrastructure. Instead, the rootkit intercepts inbound TCP traffic, analyzes it for specific patterns, and embeds encrypted communications with the operator into existing legitimate connections. This approach makes detection by conventional network monitoring extremely difficult.
Additionally, according to Broadcom, Daxin supports multi-hop communication through chains of infected hosts, allowing operators to reach systems in isolated network segments that are physically disconnected from the internet.
Stupig backdoor: executing commands from the Windows logon screen
Stupig is a DLL backdoor detected under the filenames a.dll and kbdus1.dll. The filename kbdus1.dll imitates the legitimate Microsoft library kbdus.dll, which is responsible for the US English keyboard layout.
Stupig’s persistence mechanism is based on registering itself as a keyboard layout provider. When the system boots, the win32k.sys driver loads the malicious DLL into the winlogon.exe process. The library returns a valid KBDTABLES pointer, allowing the keyboard layout to continue functioning normally and making the module appear legitimate during process inspection.
Once running inside winlogon.exe, Stupig monitors the username input field on the Windows logon screen. When a username starting with the prefix “stupig” is entered, the subsequent string is interpreted as a command and executed with SYSTEM privileges. If no command is specified after the prefix, the backdoor spawns a command shell with SYSTEM rights directly on the logon screen — before user authentication and without generating a logon audit event.
As Symantec and Carbon Black note: “By hiding within the Windows logon process and registering as a keyboard layout provider, Stupig grants operators SYSTEM-level command execution and the ability to steal credentials before user logon — an access method most defenders are unaware of and do not monitor.”
Relationship between Daxin and Stupig
According to the researchers, no direct code-level overlaps between Daxin and Stupig have been identified. However, their joint deployment on the same host, complementary functionality, similar development practices, and identical 2013 compilation timestamps suggest that both tools may have been created by the same group. Daxin was previously attributed by researchers as a tool associated with a Chinese-speaking actor, but the current attribution remains unconfirmed.
It should be taken into account that the statement about 13 years of undetected presence is an analytical assessment based on compilation timestamps and the observed stealth of the threat, not a confirmed chronological fact. Compilation timestamps can be deliberately altered by adversaries.
Likely initial compromise vector
The exact method and timing of the host compromise remain unknown. Researchers believe the intrusion vector may have been an outdated Digiwin single sign-on (SSO) portal Digiwin, which used Java Development Kit (JDK) versions 1.5 and 1.6 that had reached end of support and date back to 2009–2011. This hypothesis is not supported by evidence of specific exploited vulnerabilities.
Parallel activity: AI models in offensive operations
In a separate study, Hunt.io reported observing a suspected Chinese-speaking actor using Anthropic Claude Code and DeepSeek models to automate intrusions into government and financial systems in Afghanistan, Thailand, Taiwan, and the United States. The conclusion is based on the discovery of an open directory at 112.213.124[.]132, whose HTTP headers match known TencShell command-and-control infrastructure.
According to Hunt.io, Claude Code acted as the execution engine for agent-based tool orchestration, bash command execution, and task parallelization, while DeepSeek-v4-pro was used as a reasoning model for generating attack logic, scripts, and decision-making.
Impact assessment
The discovery of Daxin in 2026 shows that the cyber-espionage operation was not fully terminated but instead shifted into a mode of quietly maintaining presence. Those at highest risk include:
- Manufacturing enterprises in Taiwan and Southeast Asia, especially subsidiaries of multinational corporations
- Organizations using outdated JDK versions and SSO portals without security updates
- Networks with isolated segments, where Daxin’s multi-hop communication can provide access to critical systems
Practical recommendations
- Audit keyboard layout providers: Check the Windows registry for non-standard DLLs registered as keyboard layout providers. Compare modules loaded into winlogon.exe with a baseline list of legitimate Microsoft libraries.
- Search for indicators: Check for the presence of srt64.sys, kbdus1.dll, and a.dll files on your systems. Pay attention to DLLs with names similar to kbdus.dll but differing from the original.
- Monitor network traffic: Implement deep inspection of TCP traffic to detect anomalous patterns within legitimate connections — standard monitoring of outbound connections will not detect Daxin.
- Update outdated software: Immediately decommission JDK 1.5 and 1.6, as well as any SSO portals that no longer receive security updates.
- Audit logon screen activity: Configure monitoring of logon attempts with non-standard usernames, especially those containing the string “stupig”.
- Check isolated segments: Given Daxin’s ability for multi-hop communication, audit hosts in segments considered isolated from the internet.
The Daxin and Stupig case shows that tools compiled more than a decade ago can remain effective when stealth is implemented competently. A priority action for security teams is to conduct a targeted audit of Windows keyboard layout providers and modules loaded into winlogon.exe, and to ensure there are no outdated JDK components or SSO portals in the production environment.
