Malware

Stupig

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence3

The backdoor watches the logon screen for a specific username prefix. Anything typed after that prefix runs as SYSTEM, before anyone signs in.

T1190Exploit Public-Facing ApplicationEvidence4

Initial Access Exploit Public-Facing Application T1190 Suspected entry via an outdated Digiwin SSO portal on end-of-life JDK 1.5/1.6 (leading hypothesis, unconfirmed).

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1059.003Windows Command ShellEvidence2

Whatever follows that prefix is treated as a command and executed with SYSTEM privileges... If someone types the prefix with nothing after it, the backdoor opens a command prompt with SYSTEM privileges directly on the login screen, before any user has authenticated.

T1574Hijack Execution FlowEvidence1

Stupig registers itself as a keyboard-layout provider. Windows then loads it into the logon process at startup.

T1574.001DLLEvidence2

Stupig disguises itself as kbdus1.dll, mimicking the legitimate kbdus.dll file that Windows uses for the U.S. English keyboard layout. It registers itself as a keyboard-layout provider, which causes win32k.sys to load it into winlogon.exe at system startup.

Persistence

3 techniques

T1078Valid AccountsEvidence3

The backdoor watches the logon screen for a specific username prefix. Anything typed after that prefix runs as SYSTEM, before anyone signs in.

T1547Boot or Logon Autostart ExecutionEvidence4

Persistence Boot or Logon Autostart Execution T1547 Stupig registers as a keyboard-layout provider so win32k.sys loads it (as kbdus1.dll) into winlogon.exe at startup.

T1556Modify Authentication ProcessEvidence1

Credential Access Modify Authentication Process T1556 Running in winlogon.exe, Stupig executes SYSTEM commands from the logon screen pre-authentication and can steal credentials, with no logon audit event.

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence3

The backdoor watches the logon screen for a specific username prefix. Anything typed after that prefix runs as SYSTEM, before anyone signs in.

T1547Boot or Logon Autostart ExecutionEvidence4

Persistence Boot or Logon Autostart Execution T1547 Stupig registers as a keyboard-layout provider so win32k.sys loads it (as kbdus1.dll) into winlogon.exe at startup.

Stealth

5 techniques

T1036MasqueradingEvidence5

Defense Evasion Masquerading T1036 Stupig poses as kbdus1.dll mimicking the legitimate kbdus.dll and returns a valid keyboard-table pointer so the keyboard works normally.

T1070Indicator RemovalEvidence1

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1078Valid AccountsEvidence3

The backdoor watches the logon screen for a specific username prefix. Anything typed after that prefix runs as SYSTEM, before anyone signs in.

T1574Hijack Execution FlowEvidence1

Stupig registers itself as a keyboard-layout provider. Windows then loads it into the logon process at startup.

T1574.001DLLEvidence2

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Stupig gives operators SYSTEM-level command execution and credential theft before a user signs in, an access method most defenders are not aware of nor watching for.

T1556Modify Authentication ProcessEvidence1

Collection

1 technique

T1056.001KeyloggingEvidence1

Stupig gives operators SYSTEM-level command execution and credential theft before a user signs in, an access method most defenders are not aware of nor watching for.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

ahnlab asec blogNews

Aug 19, 2026

July 2026 Threat Trend Report on APT Groups - ASEC

Malware used to execute commands with SYSTEM privileges and steal credentials in Taiwanese high-tech manufacturing environments.

alpha cyber blogNews

Jul 23, 2026

Daxin Returns: A 13-Year-Old China-Linked Rootkit That Never Called Home - Alpha Cyber

Backdoor that hides as a keyboard-layout DLL loaded into winlogon.exe at startup. It enables pre-authentication SYSTEM command execution from the Windows logon screen without generating a logon audit event.

security affairsNews

Jul 18, 2026

Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network

A DLL backdoor that masquerades as a keyboard-layout DLL to gain persistence and load into winlogon.exe at startup. It enables pre-authentication command execution with SYSTEM privileges from the Windows logon screen and supports credential theft while avoiding normal logon audit visibility.

scworldNews

Jul 16, 2026

Daxin malware resurfaces with new backdoor targeting Taiwan manufacturer | brief | SC Media

A backdoor disguised as a legitimate Microsoft DLL that allows attackers to execute commands with System privileges directly from the Windows logon screen before user sign-in, bypassing standard audit logs.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Stupig

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence3

The backdoor watches the logon screen for a specific username prefix. Anything typed after that prefix runs as SYSTEM, before anyone signs in.

T1190Exploit Public-Facing ApplicationEvidence4

Initial Access Exploit Public-Facing Application T1190 Suspected entry via an outdated Digiwin SSO portal on end-of-life JDK 1.5/1.6 (leading hypothesis, unconfirmed).

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1059.003Windows Command ShellEvidence2

T1574Hijack Execution FlowEvidence1

Stupig registers itself as a keyboard-layout provider. Windows then loads it into the logon process at startup.

T1574.001DLLEvidence2

Persistence

3 techniques

T1078Valid AccountsEvidence3

The backdoor watches the logon screen for a specific username prefix. Anything typed after that prefix runs as SYSTEM, before anyone signs in.

T1547Boot or Logon Autostart ExecutionEvidence4

Persistence Boot or Logon Autostart Execution T1547 Stupig registers as a keyboard-layout provider so win32k.sys loads it (as kbdus1.dll) into winlogon.exe at startup.

T1556Modify Authentication ProcessEvidence1

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence3

The backdoor watches the logon screen for a specific username prefix. Anything typed after that prefix runs as SYSTEM, before anyone signs in.

T1547Boot or Logon Autostart ExecutionEvidence4

Persistence Boot or Logon Autostart Execution T1547 Stupig registers as a keyboard-layout provider so win32k.sys loads it (as kbdus1.dll) into winlogon.exe at startup.

Stealth

5 techniques

T1036MasqueradingEvidence5

Defense Evasion Masquerading T1036 Stupig poses as kbdus1.dll mimicking the legitimate kbdus.dll and returns a valid keyboard-table pointer so the keyboard works normally.

T1070Indicator RemovalEvidence1

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1078Valid AccountsEvidence3

The backdoor watches the logon screen for a specific username prefix. Anything typed after that prefix runs as SYSTEM, before anyone signs in.

T1574Hijack Execution FlowEvidence1

Stupig registers itself as a keyboard-layout provider. Windows then loads it into the logon process at startup.

T1574.001DLLEvidence2

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Stupig gives operators SYSTEM-level command execution and credential theft before a user signs in, an access method most defenders are not aware of nor watching for.

T1556Modify Authentication ProcessEvidence1

Collection

1 technique

T1056.001KeyloggingEvidence1

Stupig gives operators SYSTEM-level command execution and credential theft before a user signs in, an access method most defenders are not aware of nor watching for.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

ahnlab asec blogNews

Aug 19, 2026

July 2026 Threat Trend Report on APT Groups - ASEC

Malware used to execute commands with SYSTEM privileges and steal credentials in Taiwanese high-tech manufacturing environments.

alpha cyber blogNews

Jul 23, 2026

Daxin Returns: A 13-Year-Old China-Linked Rootkit That Never Called Home - Alpha Cyber

security affairsNews

Jul 18, 2026

Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network

scworldNews

Jul 16, 2026

Daxin malware resurfaces with new backdoor targeting Taiwan manufacturer | brief | SC Media

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.