Cisco Talos exposes China-nexus group UAT-11587 using new 'Antino' backdoor against Asian governments
Cisco Talos disclosed a China-nexus threat cluster, tracked as UAT-11587, that has targeted government, defense, diplomatic and policy organizations across Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria since September 2025. The group delivers a previously undocumented Rust-compiled Windows backdoor called Antino via spear-phishing with spoofed senders and fake Gmail attachment widgets. Antino communicates covertly through Microsoft 365 (Outlook/OneDrive via Microsoft Graph) instead of a traditional C2 server, and the group heavily relies on Cloudflare infrastructure for delivery and staging. Talos found roughly 350 compromised endpoints across eight countries, with the largest wave hitting around 57 Indian endpoints in a single two-day period.