The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Cisco Talos reports that UAT-11587 targeted government, policy, and national-security-adjacent organizations in eight Asian countries using tailored spear-phishing and a previously undocumented Windows backdoor it calls Antino. The malware can run commands, move files, load code in memory, and persist on compromised systems. Its use of Microsoft Graph to communicate through Outlook and OneDrive means defenders need to correlate endpoint activity with Microsoft 365 and identity logs—not treat Microsoft cloud traffic alone as evidence of compromise. Talos assesses with high confidence that the activity is China-nexus; that is Talos’s assessment, not a government attribution.
What Talos says the campaign reached
Talos observed UAT-11587 activity from September 2025 through July 2026. By July 2026, it reported at least 10 confirmed and five probable affected institutional environments, plus one additional intended target, across eight countries. Talos also estimated approximately 350 compromised endpoints across those countries. These are investigation figures as of July 2026, not a live count or an independently verified census; “confirmed,” “probable,” and “intended” describe different evidence categories.
As an Amazon Associate I earn from qualifying purchases.
The countries Talos identified were:
- Taiwan
- India
- The Philippines
- Cambodia
- Pakistan
- Thailand
- Myanmar
- Syria
The reported targeting concerned public-sector and national-security-adjacent institutions, including government, diplomatic, legislative, research, policy, and civil-society organizations. A country’s inclusion does not mean that all its government agencies or institutions were compromised. Talos’s figures and scope are detailed in its September 30, 2026 report.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the campaign developed
Talos first identified the activity while investigating a March 2026 spear-phishing operation aimed at Taiwan’s academic, think-tank, and civil-society policy community. Its review describes earlier Philippines-themed activity, followed by wider geopolitical and policy lures and a concentrated wave directed at India.
#1 Best Overall
| Period | Activity described by Talos |
|---|---|
| September–November 2025 | Philippines-themed lures delivered through direct email attachments. |
| January 2026 | Further Philippines-focused HTA campaigns and broader policy and geopolitical lures. |
| March–early June 2026 | Activity accelerated, including the operation aimed at Taiwan’s academic and policy community that led Talos to identify the campaign. |
| June 8–9, 2026 | Talos associated around 57 newly observed endpoints with an India-focused wave. |
| Through July 2026 | Talos continued to observe campaign activity. |
The dates and endpoint estimate in this timeline are Talos’s reporting, not evidence that every listed organization received the same payload or was successfully compromised. A documented Philippines-oriented lure was titled “Resolution on the Updated Chart of Bajo de Masinloc.” Other reported themes included Taiwan information warfare, legislative tax treatment, maritime and territorial issues, foreign affairs, diplomacy, regional security, human rights, and policy.
What “China-nexus” means in this report
UAT-11587 is Talos’s tracking name for the activity. Talos assesses with high confidence that the actor is China-nexus, drawing on a combination of decoy-document metadata, repeated +08:00 timestamps alongside Simplified Chinese language metadata, China-focused Rust package mirror paths in build artifacts, and targeting themes. Talos cautions that UTC+8 by itself is not geographically distinctive. The assessment rests on the combined indicators; it should not be turned into a claim that a government has publicly attributed the operation.
Talos noted overlaps with activity Symantec tracks as Jewelbug, but said it could not independently verify a connection to the financially motivated activity associated with that name. It continues to track UAT-11587 separately. The reporting therefore does not establish a settled identity or organizational relationship between them.
How the intrusion works
The recurring attack path combines tailored email lures, script-based staging, a downloader or launcher, and DLL sideloading to run Antino:
- Spear-phishing: The target receives a tailored link or attachment. Talos describes lures that imitated Gmail’s attachment widget and sender spoofing in which the visible From identity did not align with the SMTP envelope sender. In one analyzed case, SPF passed for the envelope-sender domain while DMARC alignment failed; a non-enforcing
p=nonepolicy allowed delivery. That was a specific case, not a finding about every targeted organization. - Script stager: A malicious HTA or WSF file launches, followed by JScript that downloads and decrypts additional components.
- Loader chain: A .NET BinaryFormatter deserialization chain leads to a
TestAssembly.dlldownloader or launcher. - DLL sideloading: The chain uses
GatherOsState.exeto sideloadslc.dll, the Antino payload. Talos saysGatherOsState.exeis a legitimate Microsoft-signed Windows ADK file abused for this purpose; a valid signature alone does not establish that a process is behaving benignly. - Cloud command channel: Antino uses Microsoft Graph to exchange commands and data through Outlook and OneDrive.
Talos observed Cloudflare Pages hosting malicious HTA/WSF files and execution tracking, Cloudflare R2 holding encoded stages and payload components, and Amazon CloudFront serving some scripts and decoys. Those service names alone are not reliable indicators of malicious activity: the same providers host legitimate content.
What Antino can do
Talos observed 32-bit and 64-bit Antino builds in standalone and DLL forms, and describes two generations. Capabilities vary by generation and build; the names below are documented handler names, not a promise that every sample implements every function.
| Handler | Documented function |
|---|---|
cmd, powershell |
Run shell or PowerShell commands. |
system_info |
Gather system information. |
execute_program |
Run a program. |
list_files |
List files. |
download_file |
Send files from the endpoint to the actor’s OneDrive (exfiltration, from the operator’s perspective). |
upload_file |
Stage actor-supplied files onto the victim endpoint. |
load_shellcode |
Load shellcode in memory. |
add_to_run |
Establish persistence using a Windows Run key. |
exit |
End the implant process. |
Antino’s Microsoft 365 channel uses Microsoft Graph at graph.microsoft.com and login.microsoftonline.com. Talos reports that Outlook mailbox messages carry commands and responses, while OneDrive stores heartbeat JSON and file-transfer objects. In the Gen2 behavior described by Talos, a heartbeat can include a session ID, timestamp, online status, machine name, username, platform, and campaign code; uploads recur every minute, and the implant polls its Outlook command folder every 10 seconds. These are report-derived leads, not guaranteed signatures for every build or intrusion.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTalos also describes abuse of the Windows Scripted Diagnostics workflow to run PowerShell and establish persistence through signed Windows components. Proxying execution through legitimate components does not make the resulting script, file, registry, or process activity disappear from endpoint telemetry.
Best Value
How defenders can look for it
Because the command channel uses ordinary Microsoft services, blocking Microsoft Graph, Outlook, or OneDrive wholesale would disrupt legitimate work without reliably identifying the implant. Investigate behavior and context across endpoint, identity, cloud, email, and network records. The Philippines National CERT advisory, published October 2, 2026, recommends coordinated hunting across those sources.
- Email and script execution: Review policy-, maritime-, diplomatic-, legislative-, and national-security-themed messages, especially unexpected links or HTA/WSF attachments. Look for suspicious
mshta.exe, Windows Script Host, and PowerShell activity, including launches from unusual parent processes or writable staging paths. - Process and DLL behavior: Examine process trees, script launches, DLL loads, file creation, and persistence. In particular, investigate unexpected
GatherOsState.exeactivity and loading ofslc.dll; do not treat a Microsoft signature as sufficient proof of safety. - Endpoint persistence: Check Run-key changes, user-profile staging locations, and activity involving Windows Scripted Diagnostics. Correlate these events with the processes and scripts that caused them.
- Microsoft 365 and identity: Review Microsoft Graph, Outlook, OneDrive, Entra ID, OAuth application, and authentication records for activity that is anomalous for the account, device, or organization. Correlate unusual mailbox or file operations with endpoint evidence rather than relying on cloud traffic alone.
- Cross-source indicators: Hunt Talos’s published indicators across EDR, SIEM, email, DNS, network, and cloud telemetry. Validate indicators against local context; infrastructure and indicators can change over time.
Organizations should also strengthen email filtering and endpoint controls, review SPF, DKIM, and DMARC alignment and policy, and restrict unnecessary script execution from untrusted locations. A country-themed lure is a reason to investigate in context, not proof that the recipient or organization was compromised.
What to do if you find evidence
- Follow local incident-response procedures and preserve relevant endpoint, email, network, cloud, and identity evidence before taking steps that could destroy it.
- Isolate suspected systems as appropriate, then investigate related accounts, Microsoft 365 activity, persistence, and potential access or lateral movement.
- Review potentially compromised credentials and reset them as appropriate to the evidence and response plan.
- Share validated indicators, lure samples, detection rules, affected-sector observations, and cloud or identity findings through established CERT/CSIRT channels.
These steps reflect CERT-PH’s regional guidance; apply them with the organization’s incident responders and local procedures rather than treating any single indicator as conclusive.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
