Multiple government entities targeted by China-linked Daxin malware

Threat Level – Amber | Vulnerability Report
Download PDF

For a detailed advisory, download the pdf file here

A technologically advanced and previously undocumented malware Daxin was used as the advanced persistent threat (APT) weapon by China-linked actor against government critical infrastructures across the globe. This malware can read and write arbitrary files, start and interact with arbitrary processes, and perform advanced lateral movement and stealth.

Daxin malware is a sophisticated rootkit backdoor with complicated, stealthy command and control (C2) features that allowed remote actors to communicate with secured devices that were not directly connected to the internet. This malware communicates with legitimate services through network tunneling and uses daisy-chain communication that provides it the ability to move internally via hops between several linked computers. The malware appears to be designed for the use against hardened targets, allowing actors to dig deeply into targeted networks and exfiltrate data without raising suspicions. Organizations can look for the Indicators of Compromise listed down below.

The Mitre TTPs used by Daxin malware in the current attack are:

TA0007: Discovery

TA0009: Collection

TA0006: Credential Access

T1056: Input Capture

T1049: System Network Connections Discovery

Indicators of Compromise (IoCs)

References

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox

Cyber Horizons 2025

What Last Year’s Attacks Reveal About Today’s Risks

Watch the Webinar on-demand and get a FREE copy of our Cyber Horizons 2025 report.

Our Speakers
Speaker 1

Prateek Bhajanka Global Field CISO & Former Gartner Analyst Hive Pro Inc.

Speaker 2

Ankit Mani Manager Threat Intel HiveForce Labs

Speaker 3

Sreevani Tonipe Senior Threat Researcher HiveForce Labs