State-Sponsored Espionage: 13-Year-Old Chinese "Daxin" Kernel-Mode Malware Discovered Active on Manufacturer's Network
Executive Summary
Security researchers have made a startling discovery during a compromise assessment at a major critical manufacturing organization: Daxin, a highly stealthy, state-sponsored Chinese cyber-espionage malware first compiled over 13 years ago (around 2013), was found to be active and operational within the target's internal industrial subnets. Disclosed on July 18, 2026, and reported by Pierluigi Paganini at Security Affairs, this discovery highlights the extraordinary persistence of advanced persistent threat (APT) groups.
Daxin operates as an advanced kernel-mode driver, injecting itself directly into Windows network stacks to establish communication. Rather than initiating outbound TCP connections (which would be easily flagged by modern EDR and firewall perimeters), Daxin leverages a highly sophisticated, passive communication protocol: it monitors raw, incoming network packets for specific, customized trigger patterns. When detected, it intercepts the packet and initiates a stealthy, bidirectional tunnel. This allowed the Chinese threat actors to maintain persistent, invisible, and fully remote administrative control over the manufacturer's network for more than a decade without triggering any security alerts.
Deep-Dive Technical Analysis
In the world of cyber-espionage, maintaining long-term, stealthy persistence is the ultimate goal. When threat actors compromise a target network, traditional backdoors initiate outbound connections (known as "beaconing") to command-and-control (C2) servers. However, modern network defenders utilize security information and event management (SIEM) systems and firewall egress rules to monitor for unusual outbound traffic, rendering active beaconing highly risky.
To bypass these detection boundaries, Daxin utilizes a highly sophisticated, passive communications framework:
1. The Kernel-Mode Foothold: Daxin is deployed as a malicious, high-privilege Windows kernel-mode driver (typically replacing or masquerading as a legitimate system driver). Running at the kernel level (Ring 0), the malware possesses complete, unrestricted control over the operating system, allowing it to bypass standard user-mode antivirus and host-based intrusion prevention systems.
2. Passive Packet Sniffing and Interception: Rather than initiating any outward network communication, Daxin passively intercepts and monitors all incoming network packets directly within the Windows TCP/IP driver stack.
3. The Trigger Mechanism: The threat actors communicate with Daxin by sending a seemingly normal TCP/IP packet (such as a standard HTTP or ICMP query) containing a highly specific, customized sequence of bytes embedded inside the packet header or body. Daxin's kernel listener identifies this sequence, intercepts the packet before it is processed by the legitimate host application, and establishes a secure, bidirectional communication session.
4. Stealthy Bidirectional Tunneling: This allows the attackers to establish an invisible, encrypted tunnel. Because the communication rides on top of legitimate, inbound connections that have already bypassed boundary firewalls, Daxin generates zero anomalous outbound connection alerts, remaining entirely invisible to perimeter security monitors.
5. Lateral Network Pivoting: Once a session is established, Daxin can act as a router, allowing the attackers to pivot laterally across the internal corporate intranet, cascading the compromise to other high-value assets and industrial SCADA controllers.
The forensic discovery of Daxin active on a manufacturer's network proves that state-sponsored cyber-espionage campaigns are playing a decade-long game, utilizing highly custom kernel-level backdoors to maintain persistent visibility inside critical infrastructure.
Industry Impact and Recommendations
The discovery of a 13-year-old Chinese cyber-espionage backdoor active on a manufacturing network demonstrates that traditional signature-based security and standard egress auditing are insufficient to detect highly custom, passive kernel-mode threats.
We recommend that all industrial cybersecurity teams, critical infrastructure operators, and enterprise SecOps leads implement the following mitigations:
* Enforce Rigid Kernel-Mode Driver Signing Policies: Implement and enforce strict Windows driver signing policies (such as Microsoft's Driver Signature Enforcement) to completely block the loading of unsigned or unauthorized third-party kernel-mode drivers on all enterprise endpoints.
* Deploy Behavioral-Based Endpoint Detection (EDR): Antivirus signatures are useless against custom backdoors. Ensure all endpoints are monitored by advanced EDR agents capable of performing behavioral analysis at the kernel level, instantly alerting on any unrecognized driver mounting or direct modifications to the network stack.
* Implement Deep-Packet and Anomaly Network Monitoring: Since passive backdoors rely on incoming packets with custom triggers, configure deep packet inspection (DPI) and network anomaly detection tools to monitor for unusual byte patterns or unrecognized protocols within standard incoming HTTP/ICMP streams.
* Establish Continuous, Proactive Threat Hunting: Regularly perform proactive compromise assessments and threat hunts across all critical infrastructure and SCADA networks. Audit all active system drivers, scheduled tasks, and registry keys for any unrecognized persistence mechanisms.
References
* Security Affairs — Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network
* CrowdStrike — July 2026 Patch Tuesday: Updates and Analysis