Daxin Is Back, and It Brought a Friend: Meet Stupig, the Pre-Login Backdoor Nobody Saw Coming
A sophisticated rootkit linked to Chinese state-sponsored espionage has turned up again inside a Taiwan manufacturing firm, this time sharing a host with a previously unknown backdoor that lets attackers run commands as SYSTEM before anyone has even logged in.
Daxin, the kernel-mode rootkit first exposed by Symantec in March 2022, has been lurking in targeted networks since at least 2013. Its reappearance in 2026 on a machine belonging to a Taiwan-based subsidiary of a multinational high-tech manufacturer is notable enough on its own. The second passenger on that compromised host is what really raises eyebrows.
Dubbed Stupig, the newly identified backdoor masquerades as a keyboard layout DLL. Specifically, it impersonates kbdus.dll, the legitimate Microsoft library handling the US English keyboard layout, while actually registering itself as a keyboard-layout provider. This gets it loaded by winlogon.exe at startup, tucked inside the Windows logon process where most defenders simply aren't looking.
Once running, Stupig sits and waits. It watches for usernames entered at the Windows login screen that begin with the string "stupig". Whatever follows that prefix gets executed as a SYSTEM-level command, no authentication required, no logon audit event triggered. Type nothing after the prefix and you get a full command prompt session as SYSTEM, visible on the logon screen, before any legitimate user has touched the machine.
"A trojanized keyboard-layout DLL loaded by winlogon.exe lets an attacker run commands as System directly from the Windows logon screen, before anyone signs in and without raising a logon audit event," Symantec's threat hunter team noted. That's a clean, quiet access method that most endpoint monitoring tools aren't configured to catch.
Both Daxin and Stupig carry compilation timestamps from early 2013. The compromised machine only started reporting telemetry from May 2026, which raises the uncomfortable possibility that this intrusion sat undetected for the better part of thirteen years. The suspected initial access vector is an outdated Digiwin SSO portal still running Java Development Kit versions 1.5 and 1.6, software that Oracle end-of-lifed somewhere around 2009 to 2011.
Daxin itself remains as awkward to detect as ever. Rather than phoning home to attacker infrastructure directly, it monitors incoming TCP traffic for specific patterns and hijacks existing legitimate connections for encrypted command-and-control communications. It also supports multi-hop routing through chains of compromised hosts, meaning operators can reach machines on air-gapped or isolated network segments without generating suspicious outbound traffic. Conventional network monitoring has a hard time spotting any of this.
No shared code has been identified between Daxin and Stupig. Symantec stops short of attributing both tools definitively to the same actor, but the co-deployment, complementary capabilities, similar development patterns, and matching 2013 timestamps make independent development look unlikely.
Separately, threat intelligence firm Hunt.io has observed what appears to be a China-linked actor using both Anthropic's Claude Code and DeepSeek to automate intrusions against government and financial targets across Afghanistan, Thailand, Taiwan, and the US. The discovery stems from an open directory on a known command-and-control IP sharing fingerprints with TencShell infrastructure.
According to Hunt.io, the setup divides labour between the two models: DeepSeek handles attack logic, script generation, and decision-making, while Claude Code acts as the execution layer managing bash commands, session persistence, and task parallelisation. Offensive reasoning routed through a Chinese domestic LLM, operational execution handed to Anthropic's tooling. Efficient, if nothing else.
Taken together, the Daxin resurgence and the AI-assisted intrusion activity paint a consistent picture: this espionage operation never wound down. It just got quieter.