China-Linked Daxin Rootkit Active for 13 Years
Malware discovered on a Taiwanese company's network reveals a long-term cyber intrusion.
1Long-Term Cyber Infiltration
Symantec researchers detected the Daxin rootkit active since 2013 on a high-tech manufacturer's network in Taiwan. This shows how cyberattacks can remain undetected for years. The malware is used in targeted attacks against critical infrastructure, demonstrating advanced persistence techniques.
2Covert Communication Method
Unlike traditional malware, Daxin doesn't establish its own connections but hijacks legitimate TCP traffic. This evasion technique bypasses standard network monitoring. Encrypted command-and-control traffic blends seamlessly with normal network activity, making detection exceptionally challenging.
3Stupig Backdoor Discovery
The newly identified Stupig backdoor registers as a keyboard-layout provider, loading at system startup. This previously undocumented technique allows SYSTEM-privilege command execution before user login. The malware returns valid keyboard functions, leaving no visible traces for system administrators.
4Zero-Day Vulnerability Exploit
The likely entry point was an outdated Java Development Kit (2009-2011) running on a single sign-on portal. This exposed significant attack surface on the network. The case highlights the dangers of using end-of-life software in corporate environments, especially for critical authentication systems.
5Complementary Malware Functions
While Daxin and Stupig show no code overlap, their co-presence on the same host with identical 2013 timestamps suggests coordination. Daxin provides network persistence while Stupig offers privileged access. Together they create a powerful attack combination that evades conventional security measures.
6Cybersecurity Lessons Learned
This case underscores the need for organizations to monitor keyboard-layout DLLs and update legacy systems. A 13-year undetected intrusion demonstrates critical gaps in defense strategies. The incident serves as a wake-up call for enhanced network monitoring and proactive vulnerability management.
Original article: Security Affairs — Çin Bağlantılı Daxin Kök Kiti 13 Yıldır Aktif