Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor

Symantec discovered Backdoor.Daxin active on a compromised host in Taiwan in May 2026 alongside a previously undocumented DLL backdoor, Backdoor.Stupig, which provides pre-authentication SYSTEM command execution by registering as a keyboard-layout provider; both tools carry 2013 compile timestamps and their co-deployment suggests a long-running, China-linked espionage operation against a Taiwan-based high‑tech subsidiary, with file IOCs and detection guidance provided.