daxin_blank.sys

daxin_blank.sys is a catalog name for the kernel driver component of Daxin, a sophisticated rootkit backdoor disclosed by Symantec (Broadcom) in February 2022 and flagged by CISA in a joint advisory. Daxin is attributed to a state-sponsored threat actor and was in active use for approximately eight years before public disclosure, with the earliest known sample dating to 2013.

Daxin is not a typical BYOVD driver. It is purpose-built malware. Its kernel driver hijacks legitimate TCP connections for command-and-control communication, builds mesh relay networks across compromised systems (including air-gapped networks), and provides rootkit-level persistence. It was designed for long-duration espionage operations against government agencies and critical infrastructure.

The LOLDrivers project catalogs several Daxin samples under researcher-assigned filenames (daxin_blank.sys through daxin_blank6.sysDriverdaxin_blank6.sysDaxin variantOpen plate →); the actual filenames deployed in the wild may differ. Not a legitimate vendor driver. Presence is evidence of a targeted intrusion. If found, escalate to incident response immediately.

daxin_blank.sys is listed as malicious on the public LOLDrivers project. One distinct binary hash matching this filename is on record.