China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor

Cisco Talos describes UAT-11587, a China-nexus espionage campaign that compromised ~350 endpoints across eight Asian countries using a Rust-based backdoor called Antino. The actor employed highly tailored spear-phishing (including a forged Gmail attachment UI), Cloudflare Pages-hosted HTA/WSH stagers, .NET deserialization, DLL sideloading of a Microsoft-signed binary, and a covert C2 channel via Microsoft Graph/OneDrive using OAuth client-credentials, enabling stealthy telemetry, tasking, and data exfiltration.