Cisco Talos a publié le 30 septembre 2026 une analyse technique détaillée d'un cluster d'activité malveillante désigné UAT-11587, actif depuis septembre 2025 et attribué avec haute confiance à un acteur China-nexus. La campagne a ciblé des organisations gouvernementales et de politique publique à travers l'Asie.

A New Backdoor Hides in Microsoft 365 Traffic About 350 computers in government and policy organizations across Asia have been infected with a new backdoor called Antino. A China-linked cluster named UAT-11587 used Outlook and OneDrive as its command channel. In this way, it disguised malicious traffic as ordinary Microsoft 365 activity. Scope of the Campaign Cisco Talos has watched the campaign since at least September 2025.

A China-nexus threat actor tracked as UAT-11587 has targeted government and policy organizations across Asia and Syria using a new Rust-based Windows backdoor called Antino. The campaign relies on spear-phishing, spoofed identities, and Microsoft 365-based command-and-control through Outlook and OneDrive to deliver multi-stage malware and evade detection. #UAT11587 #Antino #Microsoft365 #Outlook...

At a Glance Attribute Details Actor or Group UAT-11587 (suspected China-nexus group; overlaps with Jewelbug) Activity Type Cyberespionage, spear-phishing, DLL sideloading, dead-drop C2 Targets or Victims Government, military, think tanks, and policy bodies across Asia Scale Approximately 350 compromised endpoints across eight countries Jurisdiction / Status Suspected Chinese state-sponsored threat group; uncharged Source