Stealthy Daxin Malware Hijacks Legitimate TCP Connections to Evade C2 Detection

Symantec researchers discovered an active intrusion (May 2026) against a Taiwan-based subsidiary that used the advanced Daxin kernel-mode backdoor—capable of hijacking legitimate TCP connections—and a newly identified DLL backdoor, Stupig, which achieves persistence by registering as a keyboard layout to load into winlogon.exe and execute SYSTEM commands from the logon screen; the report includes IOCs (SHA-256 hashes and file paths), detection guidance, and links the activity to a China-associated espionage operation.