Forest Global Training Partners

Cyber Risks · Cisco Talos

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Summary: Cisco Talos tracked a China-nexus actor it calls UAT-11587 from September 2025 through July 2026, using spear-phishing lures themed on Taiwan, Philippine, Indian and other Asian policy topics to deliver a custom Rust backdoor named Antino that uses Outlook and OneDrive objects as dead drops instead of a dedicated command server. By July 2026 Talos had identified at least 10 confirmed and five probable affected institutional environments plus one intended target, with roughly 350 compromised endpoints across eight countries.

Key Takeaway: The actor spoofed trusted senders by exploiting the gap between the SMTP envelope sender and the visible From header, and the receiving provider still accepted the message because the displayed domain used a non-enforcing p=none DMARC policy - so a DMARC failure alone did not keep the mail out of the inbox.

Read the original at Cisco Talos ↗

Topics
Malware
Related