iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cisco Talos reports that UAT-11587 targeted government, policy, and national-security-adjacent organizations across eight Asian countries with tailored spear-phishing and a previously undocumented Windows backdoor it calls Antino. The malware can run commands, move files, load code in memory, and persist on an infected system; it uses Microsoft Graph to communicate through Outlook and OneDrive. Talos assesses with high confidence that the activity is China-nexus, an intelligence assessment rather than a government attribution.
What Talos found—and what the numbers mean
Talos observed UAT-11587 activity from September 2025 through July 2026 and published its report on September 30, 2026. Its estimate of approximately 350 compromised endpoints is bounded by that investigation and end date; it is not a live count. The figures distinguish affected environments from an additional intended target:
| Talos category | Reported count by July 2026 | How to interpret it |
|---|---|---|
| Confirmed affected institutional environments | 10 | Talos classified these as confirmed in its campaign reporting. |
| Probable affected institutional environments | 5 | Talos classified these as probable, not confirmed. |
| Additional intended target | 1 | Targeting does not establish that the organization was compromised. |
| Compromised endpoints | Approximately 350 | Talos’s campaign estimate across eight countries through July 2026; not an independently verified census or current total. |
Talos therefore describes at least 16 affected or targeted institutional environments, combining distinct evidentiary categories. That figure should not be read as 16 confirmed compromises, and none of these counts measures the share of organizations in a country that were affected. Talos also associated around 57 newly observed endpoints with India during a June 8–9, 2026 activity wave.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The assessed targeting spanned Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. The organizations of interest included government, security, diplomatic, legislative, research, policy, and civil-society entities; the country list does not mean every such institution was targeted or compromised. Cisco Talos’s September 30 report provides its campaign scope and technical analysis.
#1 Best Overall
How the campaign developed
Talos first identified the activity while investigating a March 2026 spear-phishing operation aimed at Taiwan’s academic, think-tank, and civil-society policy community. Its review found earlier Philippines-themed lures and later activity with broader policy and geopolitical themes:
- September–November 2025: Philippines-themed lures were delivered as direct email attachments.
- January 2026: Further Philippines-focused campaigns used HTA files and expanded into policy and geopolitical subject matter.
- March–early June 2026: Activity accelerated, including the operation directed at Taiwan’s policy community.
- June 8–9, 2026: Talos described a concentrated India wave, associating around 57 newly observed endpoints with India.
- Through July 2026: Talos continued to observe campaign activity.
Reported bait was tailored to regional affairs and institutional interests. One Philippines-oriented lure was titled “Resolution on the Updated Chart of Bajo de Masinloc.” Other themes referenced Taiwan information warfare, legislative tax treatment, maritime and territorial issues, foreign affairs, diplomacy, regional security, human rights, and policy. These examples describe reported campaign lures, not evidence that a recipient or institution was successfully compromised.
Why Talos calls UAT-11587 China-nexus
UAT-11587 is Talos’s tracking name for the activity. Talos says its high-confidence China-nexus assessment rests on the combined picture of development, preparation-environment, and targeting indicators. Among the details it cites are decoy-document metadata, recurring +08:00 timestamps alongside Simplified Chinese language metadata, China-focused Rust package mirror paths in build artifacts, and the targeting themes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Those artifacts are indicators, not proof of an operator’s physical location or state direction. Talos specifically cautions that UTC+8 on its own is not geographically distinctive. Its assessment should not be restated as a formal attribution by a government. Talos also noted overlaps with activity Symantec tracks as Jewelbug, but said it could not independently verify a connection to financially motivated activity associated with Jewelbug and continues to track UAT-11587 separately.
How the infection chain works
The recurring branch Talos describes begins with a tailored phishing message and ends with Antino communicating through Microsoft 365 services. Individual campaigns and builds can differ; this sequence summarizes a reported chain rather than a requirement that every intrusion used every stage.
- Spear-phishing: A message uses a subject relevant to the recipient’s work and may include a malicious link or attachment. Talos describes imitation of Gmail’s attachment widget and sender spoofing.
- Scripted staging: HTA or Windows Script File (WSF) content launches a JScript stage that downloads and decrypts further content.
- Downloader and launcher: A .NET BinaryFormatter deserialization chain leads to a component Talos identifies as
TestAssembly.dll, which downloads or launches the next stage. - DLL sideloading: A legitimate Microsoft-signed Windows ADK executable,
GatherOsState.exe, is used to sideloadslc.dll, which contains Antino. A valid signature on the executable does not make the surrounding execution chain benign. - Cloud command and control: Antino uses Microsoft Graph to exchange information through Outlook and OneDrive.
Talos’s email analysis included a specific case in which SPF passed for the envelope-sender domain but DMARC alignment failed; a non-enforcing p=none policy allowed delivery. That is an example from one analyzed message, not evidence that all targeted organizations had the same mail configuration.
Rank #3
Campaign infrastructure also included Cloudflare Pages for malicious HTA/WSF files and execution tracking, Cloudflare R2 for encoded stages and payload components, and Amazon CloudFront for some scripts and decoys. These examples do not justify blanket blocking of legitimate cloud platforms. Defenders need to assess the process, account, file, and sign-in context around cloud traffic.
Recommended Free Tools
What Antino can do
Talos observed 32-bit and 64-bit Antino builds in standalone and DLL forms, and describes two generations. Across reviewed builds, the backdoor is more than a downloader: it can support operator access, reconnaissance, file transfer, and persistence. The handlers available vary by generation and build.
| Handler or capability | Reported function |
|---|---|
system_info |
Collects system information. |
cmd, powershell |
Runs shell or PowerShell commands. |
execute_program |
Launches a program. |
list_files |
Lists files. |
download_file |
From the operator’s perspective, transfers a file from the endpoint to the actor’s OneDrive. |
upload_file |
Stages an actor-supplied file onto the victim endpoint. |
load_shellcode |
Loads shellcode in memory. |
add_to_run |
Establishes persistence through a Windows Run key. |
exit |
Terminates the implant’s activity. |
The function names for file transfer can be counterintuitive: Talos describes them from the operator’s perspective, so download_file exfiltrates from the victim endpoint to the actor’s OneDrive, while upload_file moves an actor-supplied file onto the endpoint.
Why Microsoft 365 traffic is part of the detection problem
Antino contacts graph.microsoft.com and login.microsoftonline.com using Microsoft Graph. Talos reports Outlook mailbox messages carrying commands and responses, while OneDrive stores heartbeat JSON and file-transfer objects. Because Microsoft endpoints are also used legitimately, a domain match alone is weak evidence; the useful signal is the relationship between cloud activity and endpoint behavior.
In Talos’s description of Gen2, heartbeat JSON can contain a session ID, timestamp, online status, machine name, username, platform, and campaign code. The report says these heartbeat uploads recur every minute and that the implant polls its Outlook command folder every 10 seconds. Treat these timings and fields as report-derived leads for reviewed builds, not universal signatures guaranteed across every infection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Talos also describes abuse of the Windows Scripted Diagnostics workflow to execute PowerShell and establish persistence through signed Windows components. Monitoring should therefore include the scripts and processes that invoke those components, files created in writable staging locations, loaded DLLs, and registry changes—not just the reputation or signature of the final executable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What defenders should investigate
CERT-PH’s October 2, 2026 regional advisory recommends a coordinated hunt across endpoint, email, network, and cloud evidence. Prioritize behavioral correlations and use Talos’s published indicators in context:
- Email and initial execution: Review policy-, maritime-, diplomatic-, legislative-, and national-security-themed messages, especially unexpected links or HTA/WSF attachments. Look for unusual
mshta.exe, Windows Script Host, and PowerShell activity. - Endpoint process and file evidence: Correlate script launches, parent-child process relationships, writable staging paths,
GatherOsState.exeloading an unexpected DLL, and suspicious persistence or user-profile activity. A Microsoft signature by itself does not clear a process chain. - Identity and Microsoft 365: Examine Microsoft Graph, Outlook, OneDrive, Entra ID sign-ins and authentication records, OAuth applications, and mailbox or file activity for anomalous relationships to the suspected endpoint or user.
- Cross-source correlation: Search EDR, SIEM, email, DNS, network, and cloud telemetry together. Use the Talos indicators and technical details as hunting leads, not as a substitute for investigating surrounding events.
- Email and execution controls: Strengthen filtering and endpoint controls, review SPF/DKIM/DMARC alignment and enforcement, and restrict script execution from untrusted locations where operationally feasible.
If an indicator is found
- Follow local incident-response procedures and preserve relevant endpoint, email, identity, and cloud evidence before making changes that could erase it.
- Isolate suspected endpoints when warranted, then investigate associated user accounts, Microsoft 365 activity, and possible access or lateral movement.
- Review credentials and reset those that may be compromised, based on the evidence and the organization’s response procedures.
- Share validated indicators, lure samples, detection rules, and relevant cloud or identity observations through established CERT/CSIRT channels.
A country-themed lure is not proof of compromise. CERT-PH’s advisory is regional guidance; organizations should scope any incident from their own telemetry and evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
