Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor

An advanced malware previously attributed to a China-linked threat actor has resurfaced after more than four years within a Taiwan manufacturing firm, along with a previously unreported backdoor dubbed Stupig. Daxin ("srt64.sys"), as the kernel-mode rootkit is referred to, was first documented by Broadcom-owned Symantec in March 2022, with evidence indicating its use in targeted attacks aimed

The article reports that the China-linked kernel-mode rootkit Daxin has resurfaced inside a Taiwan manufacturing firm after more than four years, alongside a newly documented backdoor called Stupig.[1][3] Stupig abuses a trojanized keyboard-layout DLL loaded by winlogon.exe to run SYSTEM-level commands directly from the Windows logon screen, before any user authentication and without generating logon audit events.[1][2] From a RealGround perspective, such long-lived, stealthy kernel-level and pre-login persistence mechanisms pose a critical AI supply chain risk: the same tradecraft can be used to covertly implant and maintain access on AI infrastructure, model hosts, and data pipelines, bypassing standard monitoring and potentially enabling undetected data exfiltration or model tampering. Organizations operating AI systems should harden and continuously monitor low-level components (drivers, DLLs, logon modules), maintain a rigorous SBOM for AI infrastructure, and use red teaming to test for similar pre-auth and kernel-layer backdoor techniques on AI-serving and training environments.