Cisco Talos uncovers China-linked Antino backdoor campaign

Cisco Talos has identified a Chinese-linked threat group, UAT-11587, targeting government and policy organizations in at least eight Asian countries with a new Rust-based Windows backdoor called Antino. The campaign, observed since late 2025, used spear-phishing and a complex multi-stage infection chain, with Antino communicating exclusively via Microsoft 365 services. The group leveraged Cloudflare infrastructure for delivery and cover, with confirmed targets including institutions in Taiwan, India, and the Philippines.

• Antino is a Rust-compiled Windows backdoor
• Attackers used spear-phishing to start infections
• Campaign targeted at least eight Asian countries
• Command and control operated only via Microsoft 365
• Cloudflare services were used for delivery and staging