Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

SANS ISC Handlers Diary

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The China-nexus threat cluster UAT-11587 has been conducting targeted attacks against government and policy organizations in eight Asian countries since September 2025. It uses spear-phishing campaigns with political and diplomatic lures to deliver a Rust-compiled backdoor named Antino. Antino uniquely uses Microsoft 365 services such as Outlook and OneDrive for command-and-control communication instead of traditional C2 servers. The backdoor enables reconnaissance, command execution, file transfer, shellcode loading, and persistence. The campaign leverages Cloudflare infrastructure for delivery and employs DLL sideloading techniques.

UAT-11587 is a threat cluster attributed to a China-nexus actor targeting government and policy organizations across Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. The attackers use sophisticated spear-phishing with tailored political and diplomatic themes to deliver Antino, a previously undocumented backdoor compiled in Rust. Antino uses Microsoft 365 services (Outlook and OneDrive) as dead-drop command-and-control channels, avoiding traditional C2 infrastructure. The malware supports multiple capabilities including reconnaissance, command execution, file transfer, shellcode loading, and persistence. The infection chain uses Cloudflare infrastructure and DLL sideloading to evade detection. Attribution is supported by metadata artifacts such as Simplified Chinese language usage, UTC+8 timestamps, and China-focused Rust package mirrors.

Detailed information about China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor. Get real-time updates, technical 

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor - Live Threat Intelligence - Threat Radar | OffSeq.com

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Threats Tagged 'microsoft 365 c2'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'microsoft 365 c2'

Lead Pen Test Professional