UAT-11587 (Threat actor): news timeline & CVEs

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Cisco Talos says China-nexus UAT-11587 deployed the Antino backdoor against Asian government and policy organizations.

Cisco Talos says China-nexus cluster UAT-11587 deployed a previously undocumented Rust Windows backdoor, Antino, against government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and later Syria. Antino uses Microsoft Graph with Outlook and OneDrive as dead-drop command and control and supports reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode, and persistence. Access begins with spear-phishing that spoofs trusted senders and a fake Gmail attachment card leading to an HTA or WSF stager, then DLL sideloading via GatherOsState.exe. Talos notes overlap with Jewelbug and related clusters but tracks this activity separately.

The Hacker News17:33 UTC · 3h agoThreat actor in the wild 3 sources

China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor

Cisco Talos attributes UAT-11587 (China-nexus) to compromising ~350 endpoints in eight Asian countries using the Antino backdoor with Microsoft Graph-based C2.

Cisco Talos tracks China-nexus cluster UAT-11587 compromising roughly 350 endpoints across government, defense, diplomatic, academic and civil-society organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria between September 2025 and July 2026. Spear-phishing lures replicate Gmail's attachment-preview widget, deliver HTA/WSH stagers via mshta.exe, and load the Rust-based Antino backdoor through DLL sideloading with the Microsoft-signed GatherOsState.exe. Antino uses Microsoft Graph API with an Entra ID OAuth client-credentials flow to use attacker-controlled Outlook and OneDrive as dead-drop C2, uploading heartbeats to OneDrive every minute and polling an Outlook mailbox for commands every 10 seconds.

GBHackersupdated 17:33 UTC · 3h agofirst Oct 1, 11:44 UTC · 1d agoThreat actor in the wild 3 sources

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos attributes China-nexus UAT-11587 to espionage against Asian governments using the Rust-based Antino backdoor, with ~350 compromised endpoints in eight countries.

Cisco Talos tracks UAT-11587, a China-nexus espionage actor first observed in September 2025, targeting government and policy organizations across Asia including Taiwan, India, the Philippines, and Cambodia. The actor delivers a previously undocumented Rust-compiled Windows backdoor called Antino, which supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Antino's C2 operates exclusively through Microsoft Graph, using Outlook and OneDrive objects as dead drops instead of a dedicated command server. By July 2026, Talos identified at least 16 affected or targeted institutional environments across eight countries, totaling approximately 350 compromised endpoints, with delivery via spear-phishing, tailored decoy documents, a five-stage infection chain, and heavy Cloudflare infrastructure use. Talos found partial overlap with Symantec's Jewelbug reporting but tracks UAT-11587 as a separate cluster.

Cisco Talosupdated 17:33 UTC · 3h agofirst Sep 30, 10:00 UTC · 2d agoThreat actor 3 sources

UAT-11587

Timeline3 articles

Appears with

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor