Antino (Organization): news timeline & CVEs

Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365

Antino Windows backdoor routes its entire command-and-control through Microsoft 365, using themed HTA/WSF stagers against Taiwan, Tibet, and Latin America targets.

Analysis documents the Antino Windows backdoor, whose entire C2 channel is hidden inside Microsoft 365 services. Dozens of HTA and WSF stagers use geopolitically themed lures—including CSIS Indo-Pacific, Taiwan information-warfare workshops, TPiE inauguration, Venezuela/Ukraine news, and cross-border repression seminars—to deliver a multi-stage chain. This comprises a Stage 2 JScript downloader/decryptor, encrypted JScript orchestrators, encrypted BinaryFormatter resources, TestAssembly.dll downloaders, and final slc.dll backdoors in Gen 1 and Gen 2 variants plus standalone fake installers.

Cyber Security NewsOct 1, 16:06 UTC · 1d agoMalware in the wild

China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor

Cisco Talos attributes UAT-11587 (China-nexus) to compromising ~350 endpoints in eight Asian countries using the Antino backdoor with Microsoft Graph-based C2.

Cisco Talos tracks China-nexus cluster UAT-11587 compromising roughly 350 endpoints across government, defense, diplomatic, academic and civil-society organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria between September 2025 and July 2026. Spear-phishing lures replicate Gmail's attachment-preview widget, deliver HTA/WSH stagers via mshta.exe, and load the Rust-based Antino backdoor through DLL sideloading with the Microsoft-signed GatherOsState.exe. Antino uses Microsoft Graph API with an Entra ID OAuth client-credentials flow to use attacker-controlled Outlook and OneDrive as dead-drop C2, uploading heartbeats to OneDrive every minute and polling an Outlook mailbox for commands every 10 seconds.

GBHackersupdated 17:33 UTC · 4h agofirst Oct 1, 11:44 UTC · 1d agoThreat actor in the wild 3 sources

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos attributes China-nexus UAT-11587 to espionage against Asian governments using the Rust-based Antino backdoor, with ~350 compromised endpoints in eight countries.

Cisco Talos tracks UAT-11587, a China-nexus espionage actor first observed in September 2025, targeting government and policy organizations across Asia including Taiwan, India, the Philippines, and Cambodia. The actor delivers a previously undocumented Rust-compiled Windows backdoor called Antino, which supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Antino's C2 operates exclusively through Microsoft Graph, using Outlook and OneDrive objects as dead drops instead of a dedicated command server. By July 2026, Talos identified at least 16 affected or targeted institutional environments across eight countries, totaling approximately 350 compromised endpoints, with delivery via spear-phishing, tailored decoy documents, a five-stage infection chain, and heavy Cloudflare infrastructure use. Talos found partial overlap with Symantec's Jewelbug reporting but tracks UAT-11587 as a separate cluster.

Cisco Talosupdated 17:33 UTC · 4h agofirst Sep 30, 10:00 UTC · 2d agoThreat actor 3 sources

Antino

Timeline3 articles

Appears with

Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365

China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor