Derp.ca

Daxin

Daxin is a highly sophisticated Windows kernel-mode backdoor and rootkit associated with China-linked espionage activity.

Daxin

Family profile

Daxin is a highly sophisticated Windows kernel-mode backdoor and rootkit associated with China-linked espionage activity. Public reporting places its use as far back as 2013, with operations against governments, critical infrastructure, and later a Taiwanese high-tech manufacturing environment. It is notable for long-term stealth, deep integration with the Windows networking stack, and design choices suited for segmented, heavily defended networks.

Daxin is implemented as a signed kernel driver and masquerades as legitimate system software. It hooks Windows NDIS and TCP/IP structures, registers as a protocol driver, and effectively operates its own malicious TCP/IP functionality alongside the legitimate stack. Rather than relying on obvious outbound beaconing, it monitors inbound TCP traffic for specific trigger patterns, hijacks selected legitimate connections, and establishes encrypted command-and-control channels over those sessions. It can also forge packets, send DNS requests, and tunnel traffic through compromised hosts, enabling multi-hop access to isolated systems without direct internet connectivity.

Its backdoor functionality includes arbitrary file read and write, remote command execution, execution of EXE payloads, DLL execution via injection into user-mode processes, and communication with additional local components. Earlier technical analyses also documented kernel-assisted remote execution using APC-based user-mode shellcode delivery. Daxin has been observed executing commands with SYSTEM privileges and stealing credentials in Taiwanese high-tech manufacturing environments.

Persistence and concealment are central to Daxin’s design. It stores encrypted configuration data in the Windows Registry, uses packing and obfuscation in some samples, and blends malicious traffic into normal network activity. Its architecture supports covert relay operations across chains of infected nodes, making it especially effective for espionage inside hardened enterprise and critical infrastructure networks.

Daxin is widely regarded as one of the most technically advanced malware platforms publicly linked to a China-aligned espionage actor.

Capabilities

  • Credential Theft
  • Defense Evasion
  • Exfiltration
  • Persistence
  • Post Exploitation
  • Process Injection
  • Spoofing

Samples

Recent samples

1 sandbox sample in the Derp library, newest 1 shown

e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e
Analysed Sep 30, 2026Triage report

MITRE ATT&CK

Daxin in ATT&CK

27 distinct techniques

Techniques

27 techniques
T1083 File and Directory Discovery T1027 Obfuscated Files or Information T1090 Proxy T1573 Encrypted Channel T1105 Ingress Tool Transfer T1112 Modify Registry T1055.004 Asynchronous Procedure Call T1565.001 Stored Data Manipulation T1059 Command and Scripting Interpreter T1543.003 Windows Service T1572 Protocol Tunneling T1218 System Binary Proxy Execution T1036 Masquerading T1055 Process Injection T1059.003 Windows Command Shell T1574 Hijack Execution Flow T1014 Rootkit T1071 Application Layer Protocol T1106 Native API T1040 Network Sniffing T1095 Non-Application Layer Protocol T1568 Dynamic Resolution T1090.003 Multi-hop Proxy T1071.001 Web Protocols T1205 Traffic Signaling T1190 Exploit Public-Facing Application T1090.001 Internal Proxy

Reporting

Research mentioning Daxin

Jul 22
Security Online Info

Daxin Malware Resurfaces in Taiwan With Stupig Backdoor

Symantec reported that Daxin, a stealthy malware family it previously described as among the most advanced linked to a China-aligned threat actor, has reappeared after several years of inactivity. The malware was identified running inside a manufacturing company in Taiwan, indicating that the operators have resumed use of the platform in a live intrusion. The latest activity also involved deployment of a new backdoor, suggesting the threat actor has updated its tooling or tradecraft alongside Daxin’s return. The combination of a historically sophisticated malware framework and newly observed access tooling points to an ongoing espionage-focused campaign targeting organizations in Taiwan.
Jul 18
Security Affairs

Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network
Jul 16
Scworld

Daxin malware resurfaces with new backdoor targeting Taiwan manufacturer | brief | SC Media
Jul 16
The Hacker News

Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor
Jul 16
Cyberaccord

Hackers Can Type a Secret Username at the Windows Login Screen to Open a SYSTEM Shell - Cyber Accord
Jul 15
Malware News

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor - Malware News - Malware Analysis, News and Indicators
Jul 15
Symantec

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor | SECURITY.COM