Loading story…
Symantec disclosed Backdoor.Daxin, a highly sophisticated Windows kernel-driver backdoor tied with high confidence to China-linked espionage actors and used against governments and critical infrastructure organizations, including telecommunications, transportation, manufacturing, and technology entities. Investigators said the malware had likely been in use since at least 2013 and was observed as recently as late 2021, indicating a mature capability designed for long-term covert access inside segmented or otherwise hardened environments with limited internet connectivity.
Technical analyses show Daxin disguises itself as a driver, hooks Windows NDIS and TCPIP networking components, hijacks legitimate TCP connections instead of opening its own services, and can relay command-and-control traffic across multiple compromised hosts to create multi-hop covert channels. Researchers also documented HTTP-based encapsulation, a configurable remote TCP HOST mode, traffic inspection using a magic value 0x9910, file upload and remote command execution capabilities via WinExec, and links to older China-associated tooling such as Backdoor.Zala, Trojan.Owprox, and Trojan.Emulov; Symantec said it worked with CISA and foreign governments to support detection and remediation.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Symantec published a follow-up technical analysis detailing Daxin's communications protocol, key exchange, HTTP encapsulation, and multi-hop relay capabilities across infected hosts.
A GitHub Gist published code to decrypt an embedded driver from a Daxin malware sample, describing a modified RC4 routine and MD5-based key generation with sample-specific constants. The script was tailored to a specific sample and enabled extraction of the plaintext driver from encrypted input.
Symantec published its report on Backdoor.Daxin, describing a highly sophisticated China-linked espionage backdoor used against governments and critical infrastructure organizations.
Symantec found strong evidence that Daxin was used as recently as November 2021, indicating the espionage campaign remained active into late 2021.
Symantec reported that the earliest known Daxin sample dates to 2013 and already contained the advanced features seen in later variants.
Symantec assessed that the threat actor behind both Daxin and the related Backdoor.Zala/Exforel malware family was active no later than 2009.
Through Broadcom's participation in the JCDC, Symantec worked with CISA to engage multiple foreign governments targeted with Daxin and helped them detect and remediate infections.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 34 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
symantec-enterprise-blogs.security.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourcenzz.ch
Open sourcegist.github.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceteamt5.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec reported that **Daxin**, a stealthy malware family it previously described as among the most advanced linked to a China-aligned threat actor, has reappeared after several years of inactivity. The malware was identified running inside a **manufacturing company in Taiwan**, indicating that the operators have resumed use of the platform in a live intrusion. The latest activity also involved deployment of a **new backdoor**, suggesting the threat actor has updated its tooling or tradecraft alongside Daxin’s return. The combination of a historically sophisticated malware framework and newly observed access tooling points to an ongoing espionage-focused campaign targeting organizations in Taiwan.
Jul 22, 2026
Researchers identified **RedXOR**, a Linux backdoor disguised as a `polkit` daemon, and assessed it was likely operated by a Chinese nation-state actor based on victimology, tactics, and code overlaps with malware associated with the **Winnti** umbrella. The malware targets Linux endpoints and servers, persists through init scripts, and uses the **Adore-ng** LKM rootkit for stealth. It supports host reconnaissance, file manipulation, remote shell access, self-update and uninstall functions, rootkit deployment, and network tunneling through a modified **Rinetd** component. RedXOR communicates with command-and-control infrastructure over TCP traffic made to resemble HTTP and uses XOR-based encoding to obscure data in transit. Researchers reported low antivirus detection and observed sample uploads from **Taiwan** and **Indonesia**, while intermittent command-and-control availability suggested the operation was active during analysis. The activity was framed against broader reporting on Chinese intrusion groups, including archived references to **APT41** and long-running Chinese cyber-espionage operations, reinforcing the assessment that RedXOR fits an established pattern of Linux-focused tooling used in state-linked campaigns.
Aug 15, 2026
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026