Cisco Talos has documented a China-nexus cluster it tracks as UAT-11587 that targets government and policy organizations in Asia with a previously undocumented backdoor it calls Antino. In its research post, Talos lists targets in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand and Myanmar, and says the actor also turned to Syria around May 2026. Talos assesses the China-nexus link with high confidence and says it found no connection to the financially motivated activity of the Jewelbug group, so it tracks the cluster separately.
Talos says intrusions begin with spear-phishing emails tailored to political and policy themes, sent from spoofed sender identities, with a rebuilt copy of Gmail’s attachment preview used to push recipients toward malicious pages. Antino is a Rust-compiled Windows backdoor. Talos says it runs host reconnaissance, executes shell and PowerShell commands, transfers files, loads shellcode in memory and sets up persistence. Its command channel runs only through Microsoft 365, using Microsoft Graph to reach Outlook and OneDrive, so the traffic looks like ordinary Microsoft 365 use.
Talos’s detection guidance includes watching for Microsoft Graph OAuth2 client-credentials sign-ins from unexpected service principals and for DMARC alignment failures on mail that still passes SPF. Cisco provides ClamAV signatures and Snort rules for Antino.
Our read: when command traffic rides on a service the organization already trusts, a domain blocklist has nothing to block. The control that remains is knowing which applications and service principals are supposed to call Graph mail and file APIs, then alerting on any new one. Policy audiences are a recurring phishing target, as in Proofpoint’s TA419 research and Microsoft’s report on Star Blizzard.
