China-Linked UAT-11587 Exploits Microsoft 365 for Espionage
Cisco Talos has been monitoring a cluster of espionage activities attributed to a group known as UAT-11587 since September 2025. By July 2026, this group had successfully targeted at least 16 government and policy organizations across eight Asian countries. Central to their operations is a previously undocumented backdoor named Antino, which is noteworthy not for its entry methods but for its stealthy operational tactics.
Antino, developed in Rust, is compatible with both 32-bit and 64-bit versions of Windows. It encompasses standard backdoor functionalities, including shell and PowerShell access, file transfers, in-memory shellcode execution, and persistence. According to the report from Talos, "Antino is a Rust-compiled Windows backdoor that supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading and persistence. Its native command-and-control channel operates exclusively through Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive."
What sets Antino apart is its method of communication. Rather than relying on a dedicated command-and-control server, it utilizes Microsoft Graph to receive commands from an Outlook mailbox and to send stolen files to OneDrive. This approach allows its traffic to blend seamlessly with legitimate Microsoft 365 activity, making detection more challenging.
The initial phase of the attack typically involves a convincing phishing email. UAT-11587 has crafted highly targeted documents, indicating thorough research on their victims. For instance, one decoy document mimicked a legitimate Taiwan Ministry of Finance ruling, enhancing its credibility. In another instance, the attackers repurposed a real Associated Press article regarding alleged Russian proposals to the US concerning Venezuela, with malware samples surfacing shortly after the article's publication.
The delivery mechanism employed by the attackers is a simple yet effective email spoofing technique. They sent emails through a legitimate provider, using one domain as the technical sender while the visible 'From' address appeared to be the impersonated organization. Although SPF checks passed due to the authorized sending domain, DMARC detected the mismatch and failed. However, the impersonated domain had a DMARC policy set to monitoring, allowing the email to reach the inbox despite the failure.
A particularly sophisticated tactic involved recreating Gmail's attachment preview card almost perfectly using embedded images in the email's HTML. This fake preview linked to a page controlled by the attackers, making it appear legitimate to users. When opened in Gmail, it looked indistinguishable from a genuine email, as Gmail simply renders the HTML it receives.
Mechanism of the Antino Backdoor Exploit
Once the user clicks on the email, a five-stage chain reaction is triggered, utilizing legitimate-looking HTA files, Windows Script Host, and a scripted .NET deserialization exploit to load malicious code within a trusted process. Ultimately, Antino is sideloaded through a signed Microsoft diagnostic binary, meaning the backdoor is introduced by a tool that Windows inherently trusts.
Once operational, Antino checks its Outlook mailbox for new commands every ten seconds. The commands and results are transmitted as structured JSON concealed within specially formatted email subjects. Talos notes, "The Antino backdoor receives commands through email messages. The implant actively pulls commands from the threat actor’s Outlook mailbox folder every 10 seconds."
A separate system is employed to upload stolen files to one OneDrive folder while downloading attacker tools from another. The naming conventions used by the attackers further clarify their intentions: "uploads" refer to files sent to the victim, while "downloads" are files retrieved from the victim.
Attribution for this activity relies on a collection of subtle indicators rather than a single definitive piece of evidence. Metadata from decoy documents shows Simplified Chinese language tags and a UTC+8 timestamp, which aligns more closely with mainland China than Taiwan or Hong Kong, where Traditional Chinese is prevalent. Additionally, multiple Antino builds reference a Rust package mirror specifically designed to expedite dependency downloads within mainland China, suggesting a developer's choice based on convenience rather than concealment.
Filed & Cleared
The list of victims reflects the interests of an intelligence service, including defense ministries, legislatures, foreign affairs offices, and security agencies, along with think tanks and civil society organizations that possess valuable information. Approximately 350 compromised endpoints were identified across eight countries, with a significant surge of around 57 new endpoints detected in India over a two-day period in June. This pattern indicates a deliberate and sustained effort to gather intelligence.
Talos concludes, "Based on the development, preparation environment, and targeting indicators detailed in this report, we assess with high confidence that UAT-11587 is China-nexus."
