Adversary Intelligence — 2026-07-22

China-Linked Daxin Malware Resurfaces in Taiwan After Potential 13-Year Undetected Compromise of High-Tech Manufacturer

BLUFDecade-long undetected persistence in a Taiwan high-tech subsidiary signals that legacy SSO infrastructure across the island's manufacturing base likely harbors additional undiscovered Chinese implants.

Symantec's Threat Hunter Team found the China-linked Daxin kernel-mode rootkit, first documented by Symantec in March 2022, running on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer, discovered in May 2026 12. Alongside it, researchers identified a previously undocumented backdoor, Stupig, which registers as a keyboard-layout provider to gain SYSTEM-level command execution from the Windows logon screen before any user authenticates 13. Both samples carry compile timestamps from January and February 2013, and the host had no telemetry on record before May 12, indicating the tools could have been present for years before detection 1. Symantec assessed the most likely initial access vector as an outdated Digiwin single sign-on portal running end-of-life Java Development Kit versions from 2009 to 2011 13, and reported no confirmed code-level link between Daxin and Stupig despite their co-deployment and shared 2013 timestamps 1.

Analysis
Persistence for over a decade in a subsidiary of a strategically sensitive Taiwan manufacturer indicates the actor prioritizes durable access over rapid exploitation, and the pre-authentication SYSTEM technique via keyboard-layout DLLs exposes a detection gap production EDR rulesets have not addressed. Continued exposure of legacy SSO infrastructure on end-of-life JDK builds signals a broader pattern of unpatched authentication gateways serving as durable entry points across Taiwanese manufacturing networks; whether other subsidiaries in the same corporate network carry undetected implants of either tool is genuinely uncertain absent further host telemetry. Reporting traces to a single Symantec technical disclosure republished without independent corroboration, and the absence of any code-level link between Daxin and Stupig leaves open that a second, unrelated intrusion set exploited the same neglected portal independently of the original operator.

4 sources

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor - Symantec (Broadcom)
Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor - The Hacker News
Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network - Security Affairs
Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor - Security Online