Executive Summary
In May 2026, researchers identified the return of Backdoor.Daxin, an advanced kernel-mode rootkit linked to Chinese espionage, operating within a Taiwanese high-tech manufacturing subsidiary. First documented in 2022 but with origins dating back to 2013, Daxin is known for its ability to hijack legitimate TCP traffic for command-and-control (C2) and relaying commands across air-gapped network segments.
Alongside Daxin, a previously undocumented DLL backdoor named Stupig was discovered. Stupig achieves stealthy persistence by registering as a keyboard-layout provider, allowing it to be loaded into the winlogon.exe process. This enables the attacker to execute SYSTEM-level commands directly from the Windows logon screen and perform credential theft via inline hooks before any user has even authenticated.
The simultaneous presence of these tools, combined with outdated infrastructure such as end-of-life Digiwin SSO portals, suggests a highly sophisticated intrusion that may have remained undetected for over 13 years. The targeting of Taiwanese manufacturing aligns with long-standing strategic interests associated with China-linked threat groups.