Skip to main content

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

0
Medium
Published: 09/30/2026 (09/30/2026, 15:17:20 UTC)
Source: AlienVault OTX General

Description

The China-nexus threat cluster UAT-11587 has been conducting targeted attacks against government and policy organizations in eight Asian countries since September 2025. It uses spear-phishing campaigns with political and diplomatic lures to deliver a Rust-compiled backdoor named Antino. Antino uniquely uses Microsoft 365 services such as Outlook and OneDrive for command-and-control communication instead of traditional C2 servers. The backdoor enables reconnaissance, command execution, file transfer, shellcode loading, and persistence. The campaign leverages Cloudflare infrastructure for delivery and employs DLL sideloading techniques.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/30/2026, 19:06:06 UTC

Technical Analysis

UAT-11587 is a threat cluster attributed to a China-nexus actor targeting government and policy organizations across Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. The attackers use sophisticated spear-phishing with tailored political and diplomatic themes to deliver Antino, a previously undocumented backdoor compiled in Rust. Antino uses Microsoft 365 services (Outlook and OneDrive) as dead-drop command-and-control channels, avoiding traditional C2 infrastructure. The malware supports multiple capabilities including reconnaissance, command execution, file transfer, shellcode loading, and persistence. The infection chain uses Cloudflare infrastructure and DLL sideloading to evade detection. Attribution is supported by metadata artifacts such as Simplified Chinese language usage, UTC+8 timestamps, and China-focused Rust package mirrors.

Potential Impact

The Antino backdoor enables attackers to perform extensive reconnaissance, execute arbitrary commands, transfer files, load shellcode, and maintain persistence on compromised systems. This facilitates long-term espionage and data exfiltration from targeted government and policy organizations. The use of Microsoft 365 services for C2 communication complicates detection and mitigation efforts, increasing the risk of sustained unauthorized access.

Defensive Guidance

No official patch or remediation is indicated in the provided data. Organizations should focus on detecting and blocking spear-phishing attempts, monitoring for unusual use of Microsoft 365 services such as Outlook and OneDrive, and identifying DLL sideloading activities. Since this is a targeted campaign using novel C2 techniques, defenders should apply threat intelligence updates and consider enhanced monitoring of cloud service usage. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources for current remediation guidance.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/"]
Adversary
UAT-11587
Pulse Id
6abd2800997dc4232dd91d1d

Indicators of Compromise

Hash

ValueDescriptionCopy
hashe6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf
—
hash01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a
—
hashe809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34
—
hashf1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8
—
hashe2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530
—
hashe7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb
—
hash09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff
—
hashb90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e
—
hash0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd
—
hash9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3
—
hashabfa7742e315485a98a5fafd6dbfb68e
—
hashbf681f76dc3b6f497d8c58e705585ae0
—
hashcc648bee6b11ce487565ef67576eb1c6
—
hash13425b473576aa1e58eee248e7c6a2e216889c58
—
hashe3b2bba523c035177241f6f66168e60fa6abbaaf
—
hash28f754f64aeb80ba9e81f81c7b54bdd9
—
hash5510d33df957558bdde9a940d57a243f
—
hash66b40330108e5f3fedc5b313584600f1
—
hash80f759cdef77ce76d6b7cf4db20bcbe9
—
hash8b6807b6a7479a2e770eb11a14de8e2e
—
hashb7a58329428b68f2c108a0f77f1a78fc
—
hashc56fd048fdfc800a0a74ebe2cd5879bf
—
hashf78a1f29bc4dad2a74a77f652857b8e1
—
hash13b2809d42c3ce491008b2dca40ff86551be7897
—
hash3f0051891ad90fc5b56a2b6934ef3092f06d8465
—
hash456693dd3c2ca1931306cce09a8c712aa6de9e76
—
hash54336745b9944cbefc4241baff66f24d80ed0247
—
hash872a4a2ca24f5bf73b67e86243609ca93f90eb95
—
hashbe4d124725649e689322c156ea5bdc3e44e58c1f
—
hashd3b22101fe3e29640fe6b8d6aefe7708a2209cec
—
hashdd4744dd39b9cc3c61b5fa52652f67a04b4c1aec
—
hash0173d1566dcd4fd49fa25f11f14bfe4c
—
hash077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1
—
hash079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da5027513
—
hash0a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec4970
—
hash0b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc739
—
hash131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46
—
hash133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098
—
hash170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a464
—
hash17b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4b
—
hash1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da
—
hash23d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3ac
—
hash2f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05
—
hash334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100c
—
hash3a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2af
—
hash3a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02a
—
hash40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d
—
hash47f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2
—
hash484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c6506
—
hash4b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008b
—
hash4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f
—
hash5168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005ca
—
hash5555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db55041
—
hash5a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d839562
—
hash5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb
—
hash61a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da0
—
hash65f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe6770295788
—
hash6a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56
—
hash747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d533
—
hash75c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513c
—
hash7969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b838
—
hash7c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395c
—
hash7fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e32
—
hash8e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75f
—
hash971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d
—
hash9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f
—
hasha0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221
—
hasha13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dc
—
hashad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670
—
hashae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585e
—
hashaea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90
—
hashb31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40
—
hashb3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731
—
hashb75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6
—
hashb8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655
—
hashbd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4
—
hashc8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50
—
hashca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800
—
hashcd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7
—
hashd4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a
—
hashd753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf
—
hashd87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3e
—
hashe2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3f
—
hashf0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97
—
hashfdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1
—

Domain

ValueDescriptionCopy
domainwww.wps-cn.com
—

Url

ValueDescriptionCopy
urlhttps://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe
—
urlhttps://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe”.
—
urlhttps://www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe
—
urlhttps://www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe”.
—

Threat ID: 6abd59862a4e24523d629a12

Added to database: 09/30/2026, 18:48:38 UTC

Last enriched: 09/30/2026, 19:06:06 UTC

Last updated: 09/30/2026, 19:50:19 UTC

Views: 6

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses