Loading story…
Symantec reported that Daxin, a stealthy malware family it previously described as among the most advanced linked to a China-aligned threat actor, has reappeared after several years of inactivity. The malware was identified running inside a manufacturing company in Taiwan, indicating that the operators have resumed use of the platform in a live intrusion.
The latest activity also involved deployment of a new backdoor, suggesting the threat actor has updated its tooling or tradecraft alongside Daxin’s return. The combination of a historically sophisticated malware framework and newly observed access tooling points to an ongoing espionage-focused campaign targeting organizations in Taiwan.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Symantec documented a previously unknown Windows backdoor named Backdoor.Stupig on the same compromised host as Daxin at a Taiwan-based subsidiary of a multinational high-tech manufacturer. The malware abuses Windows logon by loading into winlogon.exe as a keyboard-layout provider, letting an attacker type a special "stupig"-prefixed username at the sign-in screen to spawn a SYSTEM shell or run commands.
Symantec had previously discovered Daxin and described it as the most advanced malware it had seen from a China-linked actor. The later reporting states the malware resurfaced four years after this initial discovery.
Daxin was found running inside a manufacturing company in Taiwan, marking the malware's reappearance after four years. The intrusion also involved deployment of a novel backdoor, suggesting updated tooling or tradecraft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecyberaccord.com
Open sourcemalware.news
Open sourcesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec disclosed **Backdoor.Daxin**, a highly sophisticated Windows kernel-driver backdoor tied with high confidence to China-linked espionage actors and used against governments and critical infrastructure organizations, including telecommunications, transportation, manufacturing, and technology entities. Investigators said the malware had likely been in use since at least 2013 and was observed as recently as late 2021, indicating a mature capability designed for long-term covert access inside segmented or otherwise hardened environments with limited internet connectivity. Technical analyses show Daxin disguises itself as a driver, hooks Windows `NDIS` and `TCPIP` networking components, hijacks legitimate TCP connections instead of opening its own services, and can relay command-and-control traffic across multiple compromised hosts to create multi-hop covert channels. Researchers also documented HTTP-based encapsulation, a configurable remote TCP `HOST` mode, traffic inspection using a magic value `0x9910`, file upload and remote command execution capabilities via `WinExec`, and links to older China-associated tooling such as **Backdoor.Zala**, **Trojan.Owprox**, and **Trojan.Emulov**; Symantec said it worked with **CISA** and foreign governments to support detection and remediation.
Aug 15, 2026
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026
Cisco Talos has identified a campaign since 2022 targeting telecommunications and manufacturing sectors in Central and South Asia, using a new PlugX variant with technical overlaps to RainyDay and Turian backdoors. Analysis reveals shared malware loaders, RC4 keys, and infection chains, suggesting a medium-confidence link between Naikon and BackdoorDiplomacy, or shared tooling. The campaign demonstrates advanced DLL sideloading, living-off-the-land techniques, and persistent compromise, with evidence of keylogger activity spanning nearly two years.
Jun 29, 2026