On 2 October 2026, Cisco Talos disclosed UAT-11587, a China-nexus espionage cluster that between September 2025 and July 2026 compromised roughly 350 endpoints across at least 16 confirmed and probable government, defence, diplomatic and policy-research organisations in eight Asian countries. The operation's signature tool is Antino — a Rust-compiled Windows backdoor whose command-and-control channel runs entirely through Microsoft 365.
Antino never talks to a dedicated C2 server. It authenticates to Microsoft Graph with an OAuth client-credentials token, polls an attacker's Outlook mailbox for command emails every ten seconds, and uses OneDrive folders as a dead drop for heartbeats and file transfer. All traffic terminates at graph.microsoft.com and login.microsoftonline.com — endpoints almost every enterprise allowlists. Talos tracks loose infrastructure overlap with UNC6384 and Symantec's Jewelbug, but attributes Antino to a separately managed actor. This brief rebuilds the full kill chain and gives SOC teams copy-pasteable hunts.
◈ Table of Contents
01 — Threat Actor Profile
UAT-11587Talos assesses with high confidence that UAT-11587 is China-nexus, and the judgement rests on a stack of independent indicators rather than any single artifact. Decoy documents carry Simplified Chinese metadata (a zh-CN language tag and the author string 未定义) and UTC+8 timestamps. Rust build artifacts reference rsproxy.cn, a China-focused package mirror. The targeting set — Taiwan's legislature, regional maritime and diplomatic affairs, foreign ministries — aligns tightly with established Chinese intelligence priorities.
| Attribute | Detail |
|---|---|
| Designation | UAT-11587 (Cisco Talos tracking identifier) |
| Attribution | China-nexus — High Confidence |
| Signature malware | Antino (Rust backdoor, 32- and 64-bit; Gen1 and Gen2) |
| First observed | September 2025 |
| Activity window | September 2025 – July 2026 (ongoing cluster) |
| Infrastructure overlap | Shared CloudFront distribution previously linked to UNC6384 (Arctic Wolf); loose overlap with Symantec "Jewelbug" — tracked separately due to distinct payload and C2 architecture |
| Objective | Long-term intelligence collection (espionage), not disruption or extortion |
Defence & National Security
Military, civil defence and border-security bodies — including Taiwan-focused civil-defence and legislative subjects.
Government & Diplomacy
Executive administration, foreign-affairs ministries and parliamentary institutions across the region.
Policy & Research
Think tanks, universities and human-rights / civil-society organisations working on Indo-Pacific policy.
The actor profile matters operationally: an espionage crew optimises for dwell time and quiet collection. Expect persistence, credential harvesting and selective exfiltration — not the loud, fast behaviour of a ransomware affiliate. Hunt for the long tail.
02 — Campaign Timeline
Sep 2025 → Oct 2026Talos reconstructed a ten-month operation that scaled from single-country probing to a multi-country wave, with the delivery technique and implant generation both evolving along the way.
- 1Sep – Nov 2025. Earliest observed activity: Philippines-themed lures delivered as direct email attachments. Antino Gen1 builds first compiled around October 2025.
- 2Jan 2026. Two further Philippines HTA campaigns; lure themes broaden to regional geopolitics. The standalone fake-installer delivery branch (bogus Flash / WPS installers) begins. Antino Gen2 builds appear December 2025 – January 2026.
- 3Mar 2026. Taiwan spear-phishing wave targeting the academic, think-tank and civil-society policy community.
- 4Mar – Jun 2026. Closely timed Philippines and Taiwan operations; activity extends to Cambodia, Myanmar, Syria, Pakistan and Thailand.
- 58 – 9 Jun 2026. Largest concentrated burst: roughly 57 newly observed endpoints associated with India over two days.
- 6Jul 2026. Investigation concludes with 16+ confirmed and probable affected environments across 8 countries; ~350 compromised endpoints in total.
- 72 Oct 2026. Cisco Talos publishes the campaign, naming UAT-11587 and the Antino backdoor.
03 — Initial Access
Spear-phishingEvery intrusion begins with a tailored spear-phishing email. What raises UAT-11587 above commodity phishing is the lengths it goes to defeat both authentication checks and the recipient's suspicion.
Messages are sent through the Migadu mail service using the attacker-controlled domain osc-cdn.com as the SMTP envelope sender, while the visible RFC5322 From: header is spoofed to display a trusted organisation. Because SPF authenticates only the envelope domain, SPF passes. DMARC fails on the header mismatch — but where the spoofed organisation publishes a lax p=none policy, the message is still delivered.
SPF "pass" on a message does not mean the visible sender is real. If your gateway promotes SPF-pass mail or your users trust a green banner, this technique walks straight through. DMARC alignment, not SPF alone, is what blocks display-name spoofing.
Inside the HTML body, the actor rebuilt Gmail's native attachment-preview card using four Base64-encoded PNG images embedded as inline MIME parts. The fake card looks like a genuine attachment thumbnail but is wrapped in an anchor tag pointing to attacker infrastructure. To dodge URL-extraction and detonation tooling, the link uses a protocol-relative form (a leading //) that many parsers fail to normalise.
Decoys reproduce real-looking policy material: a "Taiwan Information Warfare" workshop document, an exact copy of a Taiwan Ministry of Finance ruling on legislator tax treatment, a "CSIS Indo-Pacific Forecast 2026" event card, and geopolitically topical headlines. The specificity implies the operators researched each recipient's portfolio before writing the email.
04 — Five-Stage Execution Chain
HTA → AntinoFrom the first click, UAT-11587 runs a five-stage chain that keeps the payload off disk for as long as possible and ends with signed-binary DLL side-loading. Every network hop lands on a widely trusted cloud service.
The Cloudflare Pages URL serves an HTA (run by mshta.exe) or a WSF (via Windows Script Host) in a hidden window. The stager beacons to a fixed Cloudflare tracking host and then pulls Stage 2 from Cloudflare R2 or Amazon CloudFront. The lure title embedded in the URL plus a ?track query string gives the operators per-lure execution telemetry.
Executed in-process by mshta.exe, the Stage 2 JScript pulls three encrypted resources — a JScript orchestrator and two serialized .NET gadgets — then applies custom Base64 decoding followed by RC4 decryption with an embedded key, and runs the decrypted orchestrator.
The orchestrator instantiates COM-visible .NET classes and feeds attacker-controlled serialized data to BinaryFormatter. Gadget one tries to disable the ActivitySurrogateSelector deserialization guard; gadget two uses the System.Windows.Forms.AxHost+State gadget with the ActivitySurrogateSelector chain. The result loads an embedded PE, TestAssembly.dll, directly into the mshta.exe process. Try/catch wrapping shows the actor planned for different .NET patch levels.
This small .NET downloader fetches the lure-specific decoy PDF plus a three-file side-loading bundle carrying nonstandard extensions (.luy, .pzs, .syk). It opens the decoy for the victim, writes the bundle to a writable staging directory, then launches the Microsoft-signed GatherOsState.exe. All builds share the AssemblyAttribute GUID b2b3adb0-1669-4b94-86cb-6dd682ddbea3 — a durable hunting pivot.
GatherOsState.exe is a legitimate Windows Assessment and Deployment Kit (ADK) binary. When it loads slc.dll from the staging directory, it calls the DLL's SLOpen export, which initialises Antino. The implant now runs under a Microsoft-signed parent with clean process ancestry.
The side-loaded DLL arrives on disk with a bogus extension (.luy/.pzs/.syk) and is renamed to slc.dll only at staging. Static file-extension allowlisting will miss it; you need to catch the write-then-rename and the GatherOsState.exe load from a non-standard path.
05 — Antino Implant Deep Dive
Rust backdoorAntino is a Rust-compiled Windows backdoor named after the AntinoApp string in its application manifest. PDB paths of the form D:\a\antino\antino\target\... reveal it was built in a GitHub Actions CI pipeline. Talos identified two generations with meaningfully different tradecraft.
| Characteristic | Antino Gen1 | Antino Gen2 |
|---|---|---|
| Build period | October 2025 | Dec 2025 – Jan 2026 |
| App identity | No manifest | AntinoApp manifest |
| Session ID | XOR/Base64 of PID, hostname, username, platform | Random UUID v4 (no host-derived data) |
| Heartbeat storage | Email drafts (sendsession / heartbeat) | JSON at /antino/heartbeats/<id>.json |
Antino stores its configuration in a custom PE section named .cfg. The structure is a 4-byte little-endian length prefix followed by XOR-encrypted JSON using the alternating key bytes 0xAB 0xCD. The config carries the embedded Graph C2 parameters, a run flag (auto-install persistence) and a launch_mode field (exe / raw / dll).
When the use_sleep_mask parameter is set, Antino hooks Sleep and VirtualAlloc and registers a vectored exception handler (VEH). On each Sleep call it flips its tracked memory region to PAGE_READWRITE and encrypts the contents in place; the access violation when execution resumes triggers the VEH, which restores protection, decrypts, and continues. The implant's code is therefore encrypted at rest in memory during its idle window, shrinking exposure to memory-scanning tools.
For indirect command execution, Antino abuses the Windows Scripted Diagnostics framework. It drives the diagnostic COM class CScriptedDiag (CLSID {1F3D8AA5-9EBF-4EE4-85C2-EA40379AEDE8}, served by sdiageng.dll), injecting an attacker PowerShell script into a temporary PCW package directory under C:\Windows\Temp\SDIAG_<GUID>. The Microsoft-signed sdiagnhost.exe then executes result.ps1 through the legitimate diagnostic workflow — proxying PowerShell and registry changes through a trusted process.
PowerShell whose parent process is sdiagnhost.exe is almost never legitimate in a normal endpoint. It is one of the highest-fidelity single signals for this campaign — alert on it with low tuning cost.
06 — The Microsoft 365 Dead-Drop C2
Graph APIThe defining feature of Antino is that it has no C2 server of its own. It authenticates to Microsoft Graph with an OAuth 2.0 client-credentials token and uses the attacker's own Microsoft 365 tenant — Outlook mailbox plus OneDrive — as a dead drop. Operator actions and implant beacons are decoupled: the human writes command emails into a mailbox; the implant reads them on its own schedule. On the wire, everything is HTTPS to graph.microsoft.com and login.microsoftonline.com.
| Channel | Mechanism |
|---|---|
| Auth | OAuth 2.0 client-credentials → Microsoft Graph token |
| Command fetch | Polls attacker Outlook mailbox every 10 seconds for subject prefix command_req_[session_id] |
| Command reply | Writes results back with subject prefix command_res_[session_id] |
| Heartbeat | Uploads /antino/heartbeats/<session_id>.json at init and every minute (session id, timestamp, online/offline, machine, user, platform, campaign code) |
| Exfiltration | Writes stolen files to OneDrive /antino_downloads/ |
| Tool delivery | Operator drops toolkit files into OneDrive /antino_uploads/ |
Network-layer blocking is near-useless here: you cannot block graph.microsoft.com in a Microsoft-shop. Detection has to move to identity (anomalous client-credential sign-ins, unexpected service principals) and endpoint (which process is talking to Graph).
07 — Commands & Post-Exploitation
10 commandsAntino exposes a compact but complete command set covering reconnaissance, execution, file transfer, in-memory code loading and persistence — everything an operator needs for hands-on-keyboard collection.
| Command | Function |
|---|---|
| cmd | Execute cmd.exe /C and capture output |
| powershell | Execute powershell.exe -Command |
| system_info | Collect host and process context |
| execute_program | Run an operator-supplied program |
| list_files | Directory enumeration |
| upload_file | Transfer a file from OneDrive to the host |
| download_file | Exfiltrate a host file to OneDrive |
| load_shellcode | Execute Base64-encoded shellcode in memory |
| add_to_run | Establish persistence via an HKCU Run value |
| exit | Stop the Antino runtime |
The add_to_run command generates PowerShell that writes an HKCU ...\CurrentVersion\Run value to relaunch the chosen Antino executable at the next user sign-in. Staged files are written under %LOCALAPPDATA%\Windows GatherOSStateKit\ — a folder name chosen to blend with the legitimate ADK binary it abuses.
08 — Indicators of Compromise
IOCsA representative selection is below; Talos publishes the complete, authoritative IOC set in its public GitHub repository (linked in Sources). Validate hits against context — several delivery services are shared cloud providers.
| Indicator | Role |
|---|---|
| osc-cdn.com | Spear-phishing envelope sender (via Migadu) |
| oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages.dev | Cloudflare Pages execution-tracking beacon |
| d2nq35tel3ucuo.cloudfront.net | CloudFront Stage 2 staging |
| pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev | Cloudflare R2 payload host |
| pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev | Cloudflare R2 payload host |
| microsoft-flash.com | Fake Flash installer (standalone Antino) |
| wps-cn.com | Fake WPS installer (standalone Antino) |
| 103.27.110.220 | Historical serving IP for wps-cn.com |
| SHA256 | Note |
|---|---|
| 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff | Gen2 slc.dll |
| e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530 | Gen2 slc.dll |
| e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb | Gen2 slc.dll |
| fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1 | Gen2 slc.dll |
| 1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da | Gen1 slc.dll |
| 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d | Gen1 standalone |
| 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd | Gen2 fake-installer |
| Artifact | Value |
|---|---|
| Side-load host | GatherOsState.exe (signed ADK binary) |
| Side-loaded DLL | slc.dll (export SLOpen) |
| Bundle extensions | .luy, .pzs, .syk |
| TestAssembly GUID | b2b3adb0-1669-4b94-86cb-6dd682ddbea3 |
| Staging folder | %LOCALAPPDATA%\Windows GatherOSStateKit\ |
| OneDrive folders | /antino/heartbeats/, /antino_downloads/, /antino_uploads/ |
| Outlook subjects | command_req_*, command_res_* |
09 — Detection & Hunt Queries
KQL · SPL · SigmaBecause the C2 hides in trusted cloud traffic, the highest-value detections are on the endpoint behaviours earlier in the chain and on anomalous identity activity. Each query below is paired KQL (Microsoft Sentinel / Defender) and SPL (Splunk), with a one-line purpose.
- Cisco Talos ClamAV: Html.Trojan.UAT-11587-* and Win.Trojan.UAT-11587-* (23 signatures)
- Snort 2 & 3 SIDs: 1:66880, 1:66881, 1:66882
- Pivot on TestAssembly GUID b2b3adb0-1669-4b94-86cb-6dd682ddbea3 across your binary corpus
- Identity: alert on OAuth client-credentials sign-ins from unexpected service principals to Graph
10 — MITRE ATT&CK Mapping
ATT&CK| Technique | ID | Where it shows up |
|---|---|---|
| Search Open Websites/Domains | T1597 | Reconnaissance of target organisations |
| Spearphishing Link | T1598.003 | Cloned Gmail widget → Cloudflare Pages |
| Spearphishing Attachment | T1566.002 | HTA / WSF delivery |
| User Execution: Malicious File | T1204.002 | Victim opens HTA / WSF |
| Command & Scripting: JavaScript | T1059.007 | Stage 2 JScript orchestrator |
| Command & Scripting: PowerShell | T1059.001 | powershell command, add_to_run |
| Indirect Command Execution | T1202 | Scripted Diagnostics / sdiagnhost.exe |
| System Binary Proxy Execution | T1218 | GatherOsState.exe side-loading slc.dll |
| Obfuscated Files or Information | T1027 | RC4 stages, XOR-encrypted .cfg |
| Deobfuscate/Decode Files | T1140 | RC4 decryption of stage resources |
| Process Injection (APC) | T1055.004 | load_shellcode in-memory execution |
| Boot/Logon Autostart: Run Key | T1547.001 | add_to_run HKCU persistence |
| Application Layer Protocol: Web | T1071.001 | Microsoft Graph HTTPS C2 |
| Data Obfuscation | T1001 | C2 blends into legitimate MS sync traffic |
| File & Directory Discovery | T1083 | list_files command |
| Exfiltration Over C2 Channel | T1041 | download_file → OneDrive |
11 — Mitigation & Hardening
Action- 1Move DMARC to
p=reject. A laxp=noneon your own domain is exactly what let UAT-11587's display-name spoofing land. Enforce alignment, not just SPF. - 2Restrict
mshta.exeandwscript.exe/cscript.exe. Block or heavily constrain them with WDAC / AppLocker; almost no business workflow needs user-launched HTA. - 3Kill BinaryFormatter. Disable or remove
BinaryFormatterdeserialization in internal .NET apps — it is deprecated and central to Stage 3. - 4Audit Graph service principals. Review app registrations with mail/file permissions, enforce least privilege, and alert on new client-credential grants. This is where the C2 hides.
- 5Hunt the durable pivots. Sweep for the TestAssembly GUID,
slc.dllside-loaded byGatherOsState.exe, and theWindows GatherOSStateKitstaging folder across the estate. - 6Deploy vendor signatures. Push the Talos ClamAV and Snort rules, and add the IOC domains/hashes to your blocklists and retro-hunt the last 12 months of telemetry.
Retro-hunt deep: this cluster has been live since September 2025 with a strong espionage emphasis on dwell time. If you are in-scope (Asian government, defence, diplomatic or policy sectors), assume you may already be compromised and hunt the 12-month window, not just the last week.
12 — Sources & References
PrimaryAre Antino's IOCs in your environment? Paste the hashes and domains from this brief into the CyberHawk IOC Scanner to triage fast, then track follow-on China-nexus activity on the CyberHawk Threat Intel feed. For detection engineering playbooks and SOC runbooks, browse the CyberHawk SOP library.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."