New Espionage Campaign Targets Asian Governments with Antino Backdoor

Government and policy organizations across Asia are facing a new cyber espionage campaign attributed to a China-nexus threat actor. This campaign has specifically targeted entities in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, utilizing a previously undocumented backdoor known as Antino. Cisco Talos has identified this threat cluster as UAT-11587.

The threat actor was first detected in September 2025 during a spear-phishing campaign aimed at Taiwan's academic and civil society sectors. Since then, the attacks have expanded, affecting 16 organizations across eight Asian countries. Security researcher Ashley Shen describes Antino as a Rust-compiled Windows backdoor capable of host reconnaissance, shell and PowerShell execution, file transfer, and persistence. Notably, its command-and-control operations are conducted through Microsoft 365, leveraging Microsoft Graph to interact with Outlook and OneDrive.

Cisco Talos has noted that UAT-11587 may share some characteristics with another group known as Jewelbug, which is associated with espionage and cryptocurrency fraud. However, Talos has not found conclusive evidence linking the two, leading to the classification of UAT-11587 as a distinct threat. The high confidence in attributing this campaign to a China-nexus actor is supported by the presence of Simplified Chinese metadata in the lure documents and the use of zh-CN language.

The campaign's targeting and lure themes align with the interests of China-nexus actors, focusing on Taiwanese political, legislative, and civil defense subjects, as well as regional government and security matters. Additionally, UAT-11587 has reportedly targeted organizations in Syria, indicating a broader scope beyond Asia.

Techniques Behind the Phishing Attacks

The initial access vector for these attacks is spear-phishing, with the threat actor employing sophisticated social engineering techniques. For instance, they have spoofed trusted sender identities to bypass security checks and used a replicated Gmail attachment preview to deceive recipients. This tactic enhances the likelihood of successful phishing attempts.

The attack chain consists of several stages, beginning with an HTA or WSF stager that ultimately deploys Antino. The phishing emails direct victims to a Cloudflare URL, which downloads an HTA or WSF file that executes a JavaScript downloader. This downloader triggers a .NET deserialization process to load a malicious DLL, which then communicates with Microsoft 365 applications for command exchange and file transfer.

Final Brief

Antino is designed to perform various functions, including host reconnaissance and command execution. It can list running processes, execute PowerShell scripts, and run commands using cmd.exe. Its unique command-and-control mechanism utilizes Outlook for command retrieval and OneDrive for file transfers, allowing it to operate without a dedicated C2 server, thereby complicating detection efforts.

The Antino backdoor also exploits the Windows Scripted Diagnostics framework to execute PowerShell commands through legitimate Windows components, further obscuring its activities from detection. This sophisticated approach to cyber espionage highlights the evolving tactics employed by threat actors in the region.