Cisco Talos reports Antino backdoor targeting Asia
Cisco Talos attributes espionage campaigns using the Antino backdoor to UAT-11587, targeting institutions in eight Asian countries.
Source: Grupo UAT-11587, ligado à China, mira governos e organizações de políticas públicas na Ásia com backdoor Antino (blog.talosintelligence.com). Text prepared with AI from this source.
What happened and what to do
In a report dated September 30, 2026, Cisco Talos describes UAT-11587 campaigns against governments and public-policy organizations in Asia. Activity was first observed in September 2025; by July 2026, Talos had identified at least 16 institutional environments affected or targeted across eight countries, including Taiwan, India, the Philippines, and Cambodia. Distribution relied on spear-phishing emails and decoy documents. The Windows backdoor Antino, compiled in Rust, supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Its command-and-control channel uses Microsoft Graph, Outlook, and OneDrive.
To reduce exposure, a company can review Microsoft 365 and Graph access rules and logs, monitor unusual activity in Outlook and OneDrive, and correlate those signals with endpoint, email, and browsing alerts. It can also strengthen detection of suspicious attachments and execution chains, establish response procedures, and test control coverage for persistence and command execution. This case calls for monitoring and operational security, not mandatory AI adoption.
How the consultancy can help
Wendelmaques can diagnose exposure across endpoints, email, and Microsoft 365, define scope and priorities, and implement and operate collection integrations, alerts, and dashboards to support detection and response.
Next step
Send a short description of your environment and security concerns to receive a scoped proposal for diagnosis and implementation.
Let's assess your project
I reply with scope and a proposal.