Malware

Stupig

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence2

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1190Exploit Public-Facing ApplicationEvidence1

Exactly how and when the host was compromised remains unknown, but it's suspected to be an outdated version of the Digiwin single sign-on (SSO) portal...

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1059.003Windows Command ShellEvidence1

When the username is entered, any string that follows the prefix is interpreted as a command and executed with SYSTEM privileges. If no command is entered after the prefix, it spawns a command prompt session as SYSTEM on the logon screen.

T1574.001DLLEvidence1

Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.

Persistence

2 techniques

T1078Valid AccountsEvidence2

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1547Boot or Logon Autostart ExecutionEvidence1

Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence2

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1547Boot or Logon Autostart ExecutionEvidence1

Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.

Stealth

4 techniques

T1036MasqueradingEvidence2

Stupig, a backdoor disguised as a legitimate Microsoft DLL.

T1070Indicator RemovalEvidence1

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1078Valid AccountsEvidence2

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1574.001DLLEvidence1

Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Jul 16, 2026

Daxin malware resurfaces with new backdoor targeting Taiwan manufacturer | brief | SC Media

A backdoor disguised as a legitimate Microsoft DLL that allows attackers to execute commands with System privileges directly from the Windows logon screen before user sign-in, bypassing standard audit logs.

the hacker newsNews

Jul 16, 2026

Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor

A DLL backdoor that persists by registering as a keyboard-layout provider so it is loaded by winlogon.exe at startup. It enables SYSTEM-level command execution from the Windows logon screen before user sign-in and can facilitate credential theft while masquerading as a legitimate keyboard-layout DLL.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Stupig

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence2

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1190Exploit Public-Facing ApplicationEvidence1

Exactly how and when the host was compromised remains unknown, but it's suspected to be an outdated version of the Digiwin single sign-on (SSO) portal...

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1059.003Windows Command ShellEvidence1

T1574.001DLLEvidence1

Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.

Persistence

2 techniques

T1078Valid AccountsEvidence2

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1547Boot or Logon Autostart ExecutionEvidence1

Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence2

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1547Boot or Logon Autostart ExecutionEvidence1

Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.

Stealth

4 techniques

T1036MasqueradingEvidence2

Stupig, a backdoor disguised as a legitimate Microsoft DLL.

T1070Indicator RemovalEvidence1

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1078Valid AccountsEvidence2

Stupig employs a novel technique, allowing attackers to execute commands with System privileges directly from the Windows logon screen before any user signs in, bypassing standard audit logs.

T1574.001DLLEvidence1

Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Jul 16, 2026

Daxin malware resurfaces with new backdoor targeting Taiwan manufacturer | brief | SC Media

the hacker newsNews

Jul 16, 2026

Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.