Daxin resurfaces in Taiwan, paired with a pre‑login SYSTEM backdoor
After a four‑year lull, Symantec found the China‑linked Daxin kernel‑mode rootkit active on a Taiwan manufacturing subsidiary in May 2026. The same host also harbored a never‑seen backdoor, Stupig, which injects a DLL into winlogon to run SYSTEM commands from the login screen, giving attackers pre‑auth code execution.