UAT-11587 is a China-nexus cyber espionage campaign uncovered by Cisco Talos that targets government and policy organizations across multiple Asian countries. The threat actor uses spear-phishing emails with customized decoy documents to initiate a multi-stage infection chain culminating in the deployment of Antino, a previously undocumented Rust-compiled Windows backdoor. Antino enables extensive post-compromise capabilities including host reconnaissance, shell and PowerShell command execution, file transfer, in-memory shellcode loading, and persistence. Its command-and-control channel is novel in that it exclusively leverages Microsoft 365 services, specifically Microsoft Graph API interactions with Outlook and OneDrive objects, to evade detection by avoiding traditional dedicated C2 servers. The campaign has been active from September 2025 through July 2026, impacting at least 16 institutional environments and approximately 350 endpoints across eight Asian countries. Talos attributes the campaign to a China-nexus actor with high confidence based on technical and operational indicators such as decoy document metadata, use of a China-focused Rust package mirror, and infrastructure overlaps. The campaign focuses on intelligence gathering from defense, government, diplomatic, security, and policy research sectors. No known exploits in the wild or vendor patches are reported.

The campaign enables persistent unauthorized access to targeted government and policy organizations across Asia, facilitating espionage through host reconnaissance, command execution, file transfers, and in-memory code loading. The use of Microsoft 365 as a covert command-and-control channel complicates detection and mitigation efforts. Approximately 350 endpoints across eight countries have been compromised, potentially exposing sensitive national security and policy information. The campaign's targeting of critical public-sector and national security-adjacent organizations indicates a significant impact on regional intelligence and security.

No official patch or remediation guidance is provided in the available information. Organizations should be aware of the spear-phishing delivery vector and the novel use of Microsoft 365 services for command-and-control. Mitigation should focus on enhancing email security to detect and block spear-phishing attempts, monitoring for unusual Microsoft 365 API activity, and applying threat intelligence to identify indicators of compromise related to Antino and UAT-11587. Since this is a targeted espionage campaign, tailored detection and response strategies are recommended. Patch status is not yet confirmed — check vendor advisories and threat intelligence updates for current remediation guidance.