UAT-11587

Summary

China-nexus espionage cluster disclosed by Cisco Talos on 30 Sep 2026 (high confidence on the China nexus; moderate-to-high on targeting). From Sep 2025 to at least Jul 2026 it compromised about 350 endpoints at government, defence, legislative, diplomatic and policy organisations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria — the biggest wave, 8–9 Jun 2026, hit some 57 new endpoints tied to India. Spoofed-sender spear-phishing with cloned Gmail attachment widgets leads to Cloudflare Pages / R2 and CloudFront-hosted HTA/WSF stagers, BinaryFormatter gadget chains and DLL side-loading of slc.dll via a signed ADK binary, ending in Antino, a Rust backdoor that uses Outlook and OneDrive through Microsoft Graph as dead-drop C2. Talos notes overlaps with Antino activity Symantec attributes to Jewelbug and a low-confidence shared CloudFront distribution with UNC6384, but tracks UAT-11587 separately.

Attribution

No service named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Cisco Talos (Research, 2026-09-30)
  High confidence: China-nexus

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Malware and tools 1

Infrastructure patterns

• Second stage staged on Cloudflare R2 and Amazon CloudFront (Talos, 2026)
• Microsoft 365 as C2: Outlook and OneDrive objects as dead drops via Graph (Talos, 2026)
• Lure mail sent via Migadu with actor domain osc-cdn[.]com as envelope sender (Talos, 2026)

Reporting and advisories 1

• Cisco Talos
  China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor