- The Daxin kernel-mode rootkit, dormant for over four years, has resurfaced on a compromised host at a Taiwan-based manufacturing subsidiary alongside a new backdoor called Stupig.
- Both malware artifacts carry compilation timestamps from early 2013, suggesting the attack may have gone undetected for 13 years.
- Stupig uses a novel technique by registering as a keyboard-layout provider, enabling SYSTEM-level command execution from the Windows logon screen before any user signs in.
A sophisticated kernel-mode rootkit known as Daxin, first documented by Symantec in March 2022, has resurfaced after more than four years inside a Taiwan-based subsidiary of a multinational high-tech manufacturer. The same compromised machine also harbored a previously unreported backdoor called Stupig, according to findings from the Symantec and Carbon Black Threat Hunter Team.
Both artifacts carry a compilation timestamp from early 2013, although the machine did not begin reporting telemetry until May 12, 2026. “The malware also supported multi-hop communications through chains of infected hosts, allowing operators to reach systems on isolated network segments,” Broadcom noted.
Daxin avoids direct outbound connections by monitoring incoming TCP traffic for specific patterns and hijacking existing legitimate connections for encrypted command-and-control. Stupig achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.
“Stupig uses a technique not documented in any known malware family,” the cybersecurity arm of Broadcom said. A trojanized keyboard-layout DLL lets an attacker run commands as System directly from the Windows logon screen before anyone signs in.
The host may have been compromised through an outdated version of the Digiwin single sign-on portal using end-of-life Java Development Kit installations. The discovery shows the cyber espionage operation never completely stopped but instead maintained stealthy persistence in targeted networks.
Meanwhile, Hunt.io observed a suspected China-linked threat actor using Anthropic Claude Code and DeepSeek models to automate intrusions against government and financial systems. “Claude Code serves as the execution engine, managing agentic tool use, bash command execution, session persistence, and task parallelization,” the threat intelligence firm said.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
