[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF5Vvy75S7Qu9zICQqc-dg8BxL4rHmVO_y2_rV2o74BY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"8060eb8f-f5e1-441f-b30c-57e196285d32","13-year-undetected-intrusion-highlights-dangers-of-legacy-systems-and-poor-monitoring","c69e9e87-90b9-44f6-a96e-9526ad671803","13-Year Undetected Intrusion Highlights Dangers of Legacy Systems and Poor Monitoring","A kernel-mode rootkit (Daxin) and a novel pre-login backdoor (Stupig) persisted undetected in a Taiwanese manufacturer's network for an estimated 13 years, likely entering through an outdated Digiwin SSO portal running legacy Java. The root cause centers on failure to patch or retire end-of-life software exposed to the internet, combined with grossly inadequate monitoring that allowed sophisticated malware to operate silently for over a decade. Stupig's ability to execute commands as SYSTEM before any user logs in is particularly alarming, as it bypasses standard authentication controls entirely. This case illustrates that unpatched legacy entry points are among the most dangerous assets in any environment, and that the absence of detected alerts is never proof of the absence of compromise.","**Immediate actions:**\n- Audit and immediately patch or decommission all internet-facing legacy applications, particularly those running end-of-life Java or outdated SSO portals.\n- Deploy endpoint detection and response (EDR) tools with kernel-level visibility to detect rootkits and pre-authentication execution anomalies.\n- Conduct a full threat-hunt across the environment using Daxin and Stupig indicators of compromise (IOCs) to assess the scope of any existing infection.\n\n**Long-term improvements:**\n- Establish a formal asset lifecycle policy that mandates retirement or compensating controls for any software beyond vendor support.\n- Implement network segmentation to isolate internet-facing portals from internal manufacturing and corporate systems.\n- Enforce a continuous vulnerability management program with regular authenticated scans of all internet-exposed assets and defined SLAs for remediation.\n\n**Detection measures:**\n- Deploy centralized SIEM with behavioral baselines to flag anomalous SYSTEM-level process execution, especially originating from the Windows logon screen (Winlogon context).\n- Enable kernel integrity monitoring and Secure Boot enforcement on all Windows endpoints to resist rootkit persistence.\n- Establish a minimum log retention policy of 12+ months and conduct periodic log-gap analyses to identify hosts with missing or suppressed telemetry.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF DE.CM-4: Malicious Code Detection","NIST CSF ID.AM-2: Software Platform Inventory","MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1078: Valid Accounts (Pre-Auth Execution)","ITIL: Problem Management — Root Cause Analysis for Legacy Risk","ISO 27001 A.12.6.1: Management of Technical Vulnerabilities",{},"published","2026-07-16T15:21:00.620998+00:00","2026-07-16T15:21:00.411+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fdaxin-resurfaces-in-taiwan-alongside.html","daxin-resurfaces-in-taiwan-alongside-stupig-pre-login-system-backdoor-7ad96f","Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":48,"name":49,"slug":50,"description":51,"color":52},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[55,59,62],{"slug":56,"name":57,"problem":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":60,"problem":61},"Automated patch management","Known holes get closed in days, not months.",{"slug":63,"name":64,"problem":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]