Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer’s Network

Symantec found the China-linked Daxin kernel rootkit and a novel Stupig backdoor on a Taiwanese manufacturer's host; both appear compiled in 2013 but produced telemetry in 2026, indicating a potential 13-year undetected intrusion. Daxin provides stealthy multi-hop C2 by hijacking existing TCP connections (useful for isolated networks), while Stupig masquerades as a keyboard-layout DLL loaded into winlogon.exe to execute SYSTEM-level commands pre-authentication—highlighting sophisticated, long-lived nation-state techniques and significant detection gaps.