China-linked Antino backdoor targets 16 Asian policy groups via Microsoft 365

October 2, 2026 at 10:33 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A China-nexus threat actor has targeted 16 government and policy entities across eight Asian countries with a previously undocumented backdoor called Antino. Cisco Talos tracks the cluster as UAT-11587 and first detected it in September 2025. The backdoor uses Microsoft 365 Outlook and OneDrive for command-and-control.

Key Facts

The campaign targeted 16 entities across eight Asian countries, including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar.
Antino is a Rust-compiled Windows backdoor that supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence.
The backdoor's command-and-control channel operates exclusively through Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive.
Cisco Talos assesses UAT-11587 as China-nexus with high confidence, citing zh-CN language, Simplified Chinese metadata, and UTC+08:00 time zone in spear-phishing headers.
The threat actor was first detected in September 2025 in a spear-phishing campaign against Taiwan's academic, think tank, and civil society policy community.

Campaign Scope

The activity targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. Cisco Talos first detected the threat actor in September 2025 in connection with a spear-phishing campaign directed against Taiwan's academic, think tank, and civil society policy community. Since then, attacks linked to the intrusion set have expanded to target 16 entities across eight Asian countries. The campaign's lure theme and targeting include Taiwanese political, legislative, civil defense, and policy research subjects, together with regional government, maritime, diplomatic, and security themes.

Antino Backdoor

Antino is a Rust-compiled Windows backdoor that supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Its native command-and-control channel operates exclusively through Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive. Nearly a dozen distinct Antino build outputs feature Cargo registry paths referencing rsproxy.cn, a high-speed domestic mirror and proxy service for crates.io catering to mainland China. A JavaScript downloader associated with UAT-11587 references d32tpl7xt7175h.cloudfront.net, a CloudFront domain previously flagged by Arctic Wolf in connection with a campaign by China-affiliated threat actor UNC6384.

Attribution Assessment

UAT-11587 is assessed to share some level of overlap with Jewelbug, which exhibits tactical similarities with China-aligned clusters known as CL-STA-0049, Earth Alux, Ink Dragon, and REF7707. A report published by Broadcom-owned Symantec and Carbon Black in August 2026 characterized Jewelbug as a China-based hackers-for-hire group that carries out espionage operations and a for-profit cryptocurrency fraud business. Cisco Talos said its own investigation has failed to unearth a connection between the espionage campaign and Jewelbug's financially motivated activity, prompting it to designate UAT-11587 as a separate activity set. The adversary has been classified as China-nexus with high confidence, citing the presence of zh-CN language and Simplified Chinese metadata in the lure documents and the UTC+08:00 time zone in the spear-phishing message header.