China-nexus UAT-11587 runs its Antino backdoor through Outlook and OneDrive
Cisco Talos links China-nexus UAT-11587 to 16 affected or targeted institutions in eight Asian countries, via a backdoor run through Microsoft 365. Its commands move through Outlook and OneDrive via Microsoft Graph, so defenders have no command server to block.
The Watch · Security desk
What happened
- Talos first saw UAT-11587 activity in September 2025, aimed at government and policy bodies in countries including Taiwan, India, the Philippines and Cambodia.
- The investigation began with a March 2026 spear-phish at Taiwan's academic, think tank and civil society policy community that mimicked Gmail's attachment interface.
- The recurring delivery path runs from a spear-phishing email and a tailored decoy document into a five-stage infection chain.
- Antino is a Rust-compiled Windows implant with reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading and persistence.
- Ten distinct Antino builds contain Cargo registry paths pointing to rsproxy.cn, a Rust package mirror for faster downloads inside mainland China.
Why it matters
- What it limits constraint Once Antino is running, domain blocklists cannot cut its command traffic without also cutting the target's own Microsoft 365 service.
- Who has to decide decision Hunting for Antino has to start on the endpoint, by asking which Windows processes call Microsoft Graph for Outlook and OneDrive objects and whether they have reason to.
- What doesn't add up contradiction Symantec puts a cryptocurrency-fraud SEO business in the access pipeline and Talos declines to, so the actor's resources and motive depend on whose boundary a defender adopts.
Next story · Security · Oct 9
Allied advisory details hacking toolkit of sanctioned Chinese firm Integrity TechConfirmed2 publishers
Talos calls the Outlook and OneDrive objects dead drops [6]. The operator leaves tasking in them and the implant collects it over Microsoft Graph. No dedicated command server sits in the path [5][6]. To a network team, the command stage looks like ordinary traffic to Microsoft 365 [20].
Talos's published material does not say whose Microsoft 365 accounts hold those objects: a tenant the actor registered, or accounts taken from victims. The answer determines which logs a defender would search.
The network indicators that do exist sit earlier in the chain. Cloudflare carried delivery, execution tracking and payload staging [8]. Entry, as Talos describes it, depends on a targeted person opening a lure written for them [7]. The lures follow a collection interest: Taiwanese political, legislative, civil defense and policy research subjects, plus regional government, maritime, diplomatic and security themes [15]. For organisations outside that profile, this actor is a low priority.
The operation is sustained. Talos has tracked it for about ten months, from September 2025 to July 2026 [19]. Over that span it saw several delivery methods, loader families and post-compromise tools [10].
Talos puts its China-nexus call at high confidence and says it rests on the totality of evidence, with no single indicator carrying it [11]. It is open about the weak pieces. UTC+8 covers mainland China, Taiwan, Hong Kong and Singapore [13]. A Taiwan-focused decoy also carried a zh-CN language tag and a Simplified Chinese author value meaning "undefined" [12]. Talos judges that combination more consistent with a mainland environment than with Taiwan or Hong Kong, where Traditional Chinese predominates [13].
Symantec published research on an activity set it calls Jewelbug while Talos was preparing its report, and Talos found overlaps with the Antino espionage [16]. Symantec reported that Jewelbug ran both espionage and cryptocurrency fraud [16]. It assessed that "the SEO business supplied access, delivery and infrastructure into the espionage operation, rather than that one person performed both roles" [17]. Talos could not independently verify a link between the espionage and the fraud. It tracks UAT-11587 as a separate activity set [18].
What to watch
- Whether Talos or Microsoft says whose Microsoft 365 accounts hold Antino's dead drops: attacker-registered tenants, or accounts taken from victims.
- Whether Talos and Symantec converge on the Jewelbug link between the cryptocurrency-fraud SEO business and the espionage operation.
- New Antino builds, or confirmed victims beyond the eight countries Talos has counted so far.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption30
- Hype gap+8
- Incentives
- Not scored
- Confidence65
Perspective Coverage
3 publishers- Builder
- Builder 32%
- Operator
- Operator 63%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Cisco Talos tracks a cluster it calls UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines and Cambodia, delivering a previously undocumented backdoor referred to as Antino in developer artifacts.
- [2]
Talos first observed UAT-11587 activity in September 2025.
- [3]
By July 2026, Talos had identified at least 16 affected or targeted institutional environments across eight Asian countries.
- [4]
Antino is a Rust-compiled Windows backdoor that supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading and persistence.
- [5]
Antino's native command-and-control channel operates exclusively through Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive.
- [6]
Antino uses Outlook and OneDrive objects as dead drops rather than depending on a conspicuous dedicated command server.
- [7]
Talos identified a recurring delivery branch that began with spear-phishing emails and tailored decoy documents, followed by a five-stage infection chain.
- [8]
The actor relied heavily on Cloudflare infrastructure for delivery, execution tracking and payload staging.
- [9]
Talos first identified the campaign while investigating a March 2026 spear-phishing campaign directed at Taiwan's academic, think tank and civil society policy community; the message recreated Gmail's attachment interface.
- [10]
The actor used several delivery methods, loader families and post-compromise tools.
- [11]
Talos assesses with high confidence that UAT-11587 is a China-nexus actor, based on the totality of corroborating technical and operational evidence rather than any single indicator.
- [12]
A Taiwan-focused decoy contains the zh-CN language tag, the Simplified Chinese author value meaning "undefined", and a +08:00 creation timestamp; both recovered spear-phishing messages contain +08:00 date headers.
- [13]
Talos says UTC+8 alone is not geographically distinctive because it is used across mainland China, Taiwan, Hong Kong, Singapore and elsewhere, but the combination with the zh-CN tag and Simplified Chinese metadata is more consistent with a mainland Chinese environment than with Taiwan or Hong Kong, where Traditional Chinese predominates.
- [14]
Ten distinct Antino build outputs contain Cargo registry paths referencing rsproxy.cn, a Rust package mirror intended to improve dependency downloads within mainland China.
- [15]
The campaign's lures and observed targets include Taiwanese political, legislative, civil defense and policy research subjects, together with regional government, maritime, diplomatic and security themes.
- [16]
Symantec published research on an activity set it tracks as Jewelbug; Talos identified overlaps between UAT-11587 and the Antino-related espionage activity attributed to Jewelbug; Symantec reported that Jewelbug conducted both espionage and cryptocurrency fraud.
- [17]
the SEO business supplied access, delivery and infrastructure into the espionage operation, rather than that one person performed both roles.
- [18]
Talos could not independently verify a connection between the espionage campaign and Jewelbug's financially motivated activity and therefore tracks UAT-11587 as a separate activity set.
- [19]
Talos has observed UAT-11587 activity for about ten months.
- [20]
Antino's command traffic goes only to Microsoft 365, so blocking it at the network layer would mean blocking the target's own Microsoft 365 access.
Sources
3 independent publishers whose own reporting we read for this story.
- blog.talosintelligence.comChina-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
1 article · September 30, 2026
- securityaffairs.comAntino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
1 article · October 3, 2026
- thehackernews.comAntino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
2 articles · October 3, 2026
Topics and entities
Topics
- Spear Phishing
- State-Sponsored Cyber Espionage
- Cloud-service command and control
- Threat Attribution