A China-nexus threat cluster designated UAT-11587 has been targeting government and policy organizations across eight Asian countries since September 2025, delivering a previously undocumented Rust-compiled backdoor called Antino. The campaign primarily affected Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria through sophisticated spear-phishing operations using tailored political and diplomatic lures. The multi-stage infection chain leverages Cloudflare infrastructure for delivery and deploys Antino, which uniquely uses Microsoft 365 services—specifically Outlook and OneDrive—as dead-drop command-and-control channels rather than traditional C2 servers. The backdoor supports reconnaissance, command execution, file transfer, shellcode loading, and persistence establishment. Attribution to Chinese nexus is based on metadata containing Simplified Chinese artifacts, UTC+8 timestamps, use of China-focused Rust package mirrors, and targeting patterns consistent with Chinese intellige...
Cisco Talos identified a China-nexus cyber espionage campaign named UAT-11587 targeting government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia. The campaign uses spear-phishing emails with tailored decoy documents to deliver a Rust-compiled Windows backdoor called Antino. Antino supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Its command-and-control communication uniquely operates through Microsoft 365 applications using Microsoft Graph to interact with Outlook and OneDrive. The campaign has affected at least 16 institutional environments across eight Asian countries with approximately 350 compromised endpoints. Talos assesses this activity as an intelligence gathering operation with moderate to high confidence. No patch or remediation guidance is provided in the report.
BambooToken is a multiplatform malware family active since at least February 2023 that uses the MQTT protocol for covert command and control. It targets Windows and Linux systems primarily across Asia and South America, infecting backend servers in various sectors including mobile apps, legal, financial, software, hotels, and GitLab instances. The malware employs sideloading via Tendyron's OnKey authentication software, common in Chinese banking and government networks. It has capabilities for host enumeration, antivirus detection, and potential keylogging and clipboard theft. The attacker uses MQTT's publish-subscribe model and Cloudflare proxies to conceal infrastructure and operations. The campaign demonstrates sophisticated operational security and widespread infections.
Acronis Threat Research Unit identified two espionage campaigns targeting Cambodian government entities in defense and public works sectors, attributed to a cluster tracked as Khmer Shadow. Both campaigns delivered a custom C++ loader named NIGHTFORGE through government-themed lures in self-extracting archives. NIGHTFORGE employs sophisticated evasion techniques including NTDLL unhooking and Hell's Gate syscall resolution to decrypt and execute a Havoc Demon payload in memory. The loader utilizes DLL sideloading through a legitimate VMware-signed binary (VMwareNamespaceCmd.exe) and establishes persistence via COM-based scheduled tasks. Despite advanced technical capabilities, the actor demonstrated poor operational security by reusing identical payloads and infrastructure across targets. The campaigns targeted Cambodia's Information Collection Bureau and Ministry of Public Works and Transport using meeting-themed social engineering lures.
