China-Linked 'Daxin' Rootkit Returns After Four Years, Found Inside Taiwan Factory

Key points

• Daxin, a rootkit tied by researchers to China-linked hackers, has resurfaced inside a Taiwanese manufacturing company after more than four years of apparent dormancy.
• The malware was found alongside a previously undocumented backdoor named Stupig, which lets attackers run commands on a machine before anyone logs in.
• Daxin was first exposed publicly by Symantec in March 2022 and had been used against government and telecom targets.
• The Taiwan intrusion targeted a manufacturer, a sector repeatedly hit by suspected Chinese espionage crews.
• No ransom demand is involved: this is an espionage operation, not a criminal shakedown.

A piece of malware that researchers thought had gone dormant is back.

Investigators have found Daxin, a stealthy rootkit long linked to hackers working on behalf of China, running inside the network of a Taiwanese manufacturing company. A rootkit is malware that buries itself deep inside a computer's operating system so that normal security tools can't see it.

Daxin sits at the kernel, the layer of Windows that controls everything else. From there it can hide files and watch traffic without triggering alarms. The Hacker News, which first reported the resurfacing, notes the malware was found on the file system as "srt64.sys", disguised as a legitimate Windows driver file.

Symantec, the security arm owned by Broadcom, first exposed Daxin publicly in March 2022. Researchers described it then as one of the most advanced pieces of Chinese state-linked malware they'd seen, used quietly for years against governments and telecoms across Asia and Africa. Then it seemed to disappear.

Who is behind it and what did they plant?

The operation is attributed to a China-linked espionage group, the same cluster Symantec tied to Daxin's earlier use. Alongside Daxin, the attackers installed a second tool that had never been publicly documented: researchers are calling it Stupig.

Stupig is a backdoor, a hidden entry point that lets attackers control an infected machine remotely. Its distinguishing feature is that it works before a user has logged in. Most backdoors need someone to sign in first. Stupig sits at the login screen, accepts commands from its operators and hands them SYSTEM-level access, the highest privilege on a Windows machine.

In plain terms: the hackers don't need an employee at their desk to run code. They own the machine from the moment it boots.

Why does a factory in Taiwan matter?

Taiwanese manufacturers produce chips and precision components that end up in everything from cars to military hardware. They're a standing target for state-backed hackers looking to steal designs or pre-position inside networks before a future crisis. Our earlier story on Operation Dragon Weave, reported 1 June 2026, found a separate China-linked campaign hitting Taiwanese government and finance targets with spear-phishing and a remote-access framework.

This isn't a ransomware case. Nobody's demanding money. Daxin has always been built to sit quietly for months or years and siphon information out, which is what makes the resurfacing significant. A tool this advanced doesn't get dusted off for a small job.

Should you worry?

Not directly, if you're a general reader. This attack isn't aimed at stealing bank details or locking laptops.

If you work at a manufacturer, an engineering firm or a parts supplier, ask your IT team whether they're monitoring for kernel-level malware and unusual driver files. The companies most exposed are those that assume they're too niche to be worth targeting. As we reported on Kubota North America's breach, intruders who get quiet access can sit undetected for weeks. The Taiwan case makes the same point at a higher level of sophistication.