China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

A China-nexus threat cluster designated UAT-11587 has been targeting government and policy organizations across eight Asian countries since September 2025, delivering a previously undocumented Rust-compiled backdoor called Antino. The campaign primarily affected Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria through sophisticated spear-phishing operations using tailored political and diplomatic lures. The multi-stage infection chain leverages Cloudflare infrastructure for delivery and deploys Antino, which uniquely uses Microsoft 365 services—specifically Outlook and OneDrive—as dead-drop command-and-control channels rather than traditional C2 servers. The backdoor supports reconnaissance, command execution, file transfer, shellcode loading, and persistence establishment. Attribution to Chinese nexus is based on metadata containing Simplified Chinese artifacts, UTC+8 timestamps, use of China-focused Rust package mirrors, and targeting patterns consistent with Chinese intellige...

• Crafty Microsoft Teams Booking Flow Disguises Device Code PhishingCampaign2026-11-12
• How AI Revived a Stalled Attack on a U.S. RetailerMalware2026-11-12
• The XG Files: Falcon C2 Flying Under The (Browser) RadarMalware2026-11-11
• Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the GlobeMalware2026-11-10
• Yoba Malware Campaign Abuses Signed AI Applications to Evade DetectionMalware2026-11-03