# China-Linked Daxin Rootkit Active for 13 Years

Malware discovered on a Taiwanese company's network reveals a long-term cyber intrusion.

- **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb)
- **Published:** 2026-07-18
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://securityaffairs.com/195577/malware/daxin-13-year-old-china-linked-malware-found-still-active-on-manufacturers-network.html>
- **On Brifing:** https://brifing.si/s/98928a1f-262a-41e0-bfdd-aa60a08055d5

## Long-Term Cyber Infiltration

Symantec researchers detected the Daxin rootkit active since 2013 on a high-tech manufacturer's network in Taiwan. This shows how cyberattacks can remain undetected for years. The malware is used in targeted attacks against critical infrastructure, demonstrating advanced persistence techniques.

## Covert Communication Method

Unlike traditional malware, Daxin doesn't establish its own connections but hijacks legitimate TCP traffic. This evasion technique bypasses standard network monitoring. Encrypted command-and-control traffic blends seamlessly with normal network activity, making detection exceptionally challenging.

## Stupig Backdoor Discovery

The newly identified Stupig backdoor registers as a keyboard-layout provider, loading at system startup. This previously undocumented technique allows SYSTEM-privilege command execution before user login. The malware returns valid keyboard functions, leaving no visible traces for system administrators.

## Zero-Day Vulnerability Exploit

The likely entry point was an outdated Java Development Kit (2009-2011) running on a single sign-on portal. This exposed significant attack surface on the network. The case highlights the dangers of using end-of-life software in corporate environments, especially for critical authentication systems.

## Complementary Malware Functions

While Daxin and Stupig show no code overlap, their co-presence on the same host with identical 2013 timestamps suggests coordination. Daxin provides network persistence while Stupig offers privileged access. Together they create a powerful attack combination that evades conventional security measures.

## Cybersecurity Lessons Learned

This case underscores the need for organizations to monitor keyboard-layout DLLs and update legacy systems. A 13-year undetected intrusion demonstrates critical gaps in defense strategies. The incident serves as a wake-up call for enhanced network monitoring and proactive vulnerability management.

## Sources covering this story

- https://securityaffairs.com/195577/malware/daxin-13-year-old-china-linked-malware-found-still-active-on-manufacturers-network.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._