Stealthy Daxin Malware Hijacks Legitimate TCP Connections to Evade C2 Detection

More than four years after its public disclosure, the advanced Daxin backdoor has resurfaced in an active intrusion targeting a Taiwan-based subsidiary of a multinational high-tech manufacturer.

Symantec’s Threat Hunter Team found the malware on a compromised Windows host in May 2026, alongside a previously undocumented DLL backdoor named Stupig.

Daxin is notable for avoiding normal command-and-control traffic. Instead of contacting attacker infrastructure directly, it hijacks legitimate TCP connections already reaching the victim network.

The discovery suggests that the China-linked espionage operation associated with Daxin may have retained long-term access to strategically important networks, potentially for years.

Daxin Hijacks Legitimate TCP

The investigation also uncovered Stupig, a new DLL backdoor found first as a.dll and later as kbdus1.dll. Its February 2013 compile timestamp is only weeks later than Daxin’s, and Symantec noted similarities in development practices.

However, researchers found no direct code-level link, so the presence of a common operator cannot be confirmed. Stupig establishes persistence by registering itself as a Windows keyboard layout provider.

This causes the Windows kernel component win32k.sys to load the malicious DLL into winlogon.exe at system startup. The DLL supplies a valid keyboard-table structure, allowing normal keyboard functions to continue and reducing suspicion during manual inspection.

Once inside winlogon.exe, Stupig waits for a username beginning with stupig to be entered at the Windows logon screen.

Any text entered after that prefix is executed as SYSTEM on the secure desktop. If an operator enters only stupig, the malware launches a SYSTEM command prompt directly from the logon screen.

The Backdoor then calls the legitimate Windows authentication function, producing an ordinary failed-login result. This leaves defenders with little evidence beyond a failed login attempt using an unusual username.

Stupig also hooks SspiCli!LsaLogonUser and Advapi32!CredUnprotectA, functions that may enable credential interception in the winlogon.exe process. It additionally references a possible companion payload, msyun.dll, which was not recovered.

After a.dll was detected on May 28, attackers or the malware operators appeared to adjust their operational security. On June 1, Stupig appeared as kbdus1.dll in the System32 directory.

The filename closely imitates the legitimate kbdus.dll keyboard-layout library, differing by just one added character.

The case reinforces the risks created by unsupported internet-facing software and the need to hunt for unusual driver installations, suspicious keyboard-layout registry entries, DLLs loaded by winlogon.exe, and unexpected failed logons beginning with stupig.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs