Dormant Daxin Malware Reappears in Taiwan With Stupig

Introduction

After remaining quiet for more than four years, a particularly stealthy piece of Windows kernel malware has unexpectedly turned up inside a manufacturing organization based in Taiwan. The discovery is notable not only because the threat was believed to be retired, but also because it arrived bundled with a never-before-seen backdoor that activates before a user even logs in. This combination suggests that sophisticated intrusion crews are recycling old tools while quietly developing new ones to maintain persistent access.

In this article, we break down what is known about the returning implant, the freshly identified Stupig component, and why its appearance inside a hardware production facility carries broader strategic weight. We also provide original analysis on what defenders should rethink in response to this blended threat pattern.

A Familiar Ghost Returns to the Supply Chain

The malware in question is a kernel-mode rootkit that was originally profiled by a major security vendor in early 2022. At the time, investigators linked the tool to a series of tightly targeted operations attributed to a threat group with suspected ties to Chinese state interests. The implant was engineered to run deep inside the Windows operating system, making it extremely difficult for standard antivirus and logging tools to detect.

What makes its reappearance striking is the gap in activity. For over four years, public reporting suggested the toolkit had faded from use. Finding it again inside a Taiwanese industrial entity implies that either archived malware was redeployed by the original authors or copied by a second-tier actor with access to leaked source code. Either scenario points to the long shelf life of well-crafted stealth malware.

Stupig: A Pre-Login Door Left Unnoticed

Alongside the older rootkit, researchers flagged a separate malicious module they named Stupig. Unlike conventional backdoors that wait for a user session, this one is built to trigger during the system’s pre-login phase. That means it can intercept or influence the machine before any credential check occurs.

Key characteristics observed include:

• Execution prior to interactive authentication, bypassing many user-aware controls
• Light footprint designed to avoid raising alerts during boot
• Cooperation with the kernel rootkit to hide its own presence from inspectors
• Likely use as a relay for later-stage payloads inside the network

The pairing of a pre-login backdoor with a kernel rootkit creates a layered persistence model: one component guarantees early access, while the other ensures both remain invisible.

Why a Taiwan Factory Matters

Taiwan remains a global hub for advanced hardware manufacturing, spanning semiconductors and critical industrial components. A compromise inside such an environment is not just a local IT issue; it can become a supply-chain risk for international customers. Intrusions of this type may aim to harvest technical data, monitor production, or establish a foothold for downstream attacks against partners abroad.

From a geopolitical lens, the return of a China-linked toolkit in this setting reinforces ongoing concerns about economic cyber espionage directed at the island’s technology sector.

Conclusion

The quiet return of a sophisticated rootkit and the debut of the Stupig pre-login backdoor inside a Taiwanese plant is a reminder that cyber threats rarely disappear for good. Organizations in sensitive industries must assume that older attack tools can be revived and combined with new techniques at any moment. Building resilient detection that spans the entire boot-to-logon window is now a baseline requirement. At Grivyonx Cloud, we continue to apply AI-driven threat modeling and continuous cybersecurity monitoring to help operational teams spot these blended intrusions before they settle into the environment.