Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
By About the Author
Excerpt
Key findings
Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational. It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered.
On the same machine, the Symantec Threat Hunter Team discovered a previously unknown backdoor, Backdoor.Stupig, whose novel tradecraft may link it to the Daxin operation, though no code-level connection has been confirmed.
Stupig uses a technique not documented in any known malware family. A Trojanized keyboard-layout DLL loaded by win…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Symantec on security.com.
More from Symantec4
- Warlock Ransomware Attackers Hit Water and Telecom OperatorsSymantec · Added 6 Oct
- Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by SideSymantec · Added 18 Aug
- GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable DefensesSymantec · Added 28 Jul
- Fast16: Pre-Stuxnet Sabotage Tool Was Built to Subvert Nuclear Weapons SimulationsSymantec · Added 23 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
