China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos documents UAT-11587, a China-nexus espionage campaign that used tailored spear-phishing lures and a five-stage infection chain to deploy a Rust-compiled backdoor named Antino; Antino performs host reconnaissance, command execution, file transfer and in-memory shellcode loading, and uses Microsoft Graph (Outlook and OneDrive) as dead-drop C2 while the campaign leveraged Cloudflare and CloudFront for staging and tracking — the report includes timeline, victimology (targeting government, security and policy organizations across multiple Asian countries), detailed TTPs, detection coverage, and dozens of IOCs.