A China-linked threat actor has launched a campaign targeting government and policy organizations across Asia using a previously unknown backdoor called Antino. The intrusion set, tracked as UAT-11587, has affected 16 entities in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria since September 2025. The malware, written in Rust, enables host reconnaissance, command execution, file transfers, and persistence on infected systems.
UAT-11587 uses a sophisticated spear-phishing approach that includes spoofed sender identities and fake Gmail attachment previews to trick recipients into downloading malicious files. The attack chain eventually deploys Antino, which communicates through Microsoft 365 services rather than traditional command-and-control servers, using Outlook for commands and OneDrive for data transfer. Attacks peaked between March and June 2026, with a concentrated wave occurring on June 8 and 9, 2026, targeting government IT infrastructure across multiple nations.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
