China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

What it is

UAT-11587 is a China-nexus actor delivering the Antino backdoor to government, defense, and policy targets across Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. Talos tracked activity from September 2025 to July 2026, identifying ~350 compromised endpoints across 10 confirmed and 5 probable institutional environments plus one intended target, with the largest wave (~57 new India endpoints) on June 8–9.

How it works

Initial access uses spear-phishing with sender spoofing: mail sent via Migadu using attacker domain "osc-cdn[.]com" as the SMTP envelope sender while the visible From header impersonates a trusted org. SPF passes (it only validates the envelope domain), and DMARC fails but is not enforced (p=none), so the spoofed mail still lands. Emails embed a cloned Gmail attachment-widget (four Base64 PNGs) linking via protocol-relative URLs (//my-<project>.pages.dev/File_download?m=<target-id>) to evade tools that only parse fully-qualified HTTP(S) links.

The five-stage chain: (1) HTA/WSF stager from Cloudflare Pages beacons to a fixed tracking host oisadjfoinsiduhfnoisdnfosdnoifnsoid[.]pages[.]dev embedding the lure title for per-campaign tracking, then pulls stage 2 from Cloudflare R2 or CloudFront d2nq35tel3ucuo[.]cloudfront[.]net; (2) JScript downloader RC4-decrypts three resources; (3) a JScript orchestrator deserializes two BinaryFormatter gadget resources — stage_1 tries disabling the .NET ActivitySurrogateSelector security check (catching exceptions for version compatibility), stage_2 uses the AxHost+State/ActivitySurrogateSelector gadget to load "TestAssembly.dll" in memory inside mshta.exe; (4) TestAssembly.dll (shared AssemblyAttribute GUID b2b3adb0-1669-4b94-86cb-6dd682ddbea3 across builds) fetches a decoy plus a 3-file sideload bundle with randomized extensions (.luy/.pzs/.syk); (5) signed ADK binary "GatherOsState.exe" sideloads "slc.dll" (Antino), launched via its SLOpen export.

Persistence/evasion: add_to_run and execute_program abuse the Windows Scripted Diagnostics framework (CLSID {1F3D8AA5-9EBF-4EE4-85C2-EA40379AEDE8} in sdiageng.dll) to get sdiagnhost.exe to run attacker PowerShell from a legitimate diagnostic package temp folder, writing an HKCU Run key. load_shellcode's use_sleep_mask option hooks Sleep/VirtualAlloc and installs a VEH to encrypt the payload region to PAGE_READWRITE between executions, decrypting on fault.

flowchart TD
    A[Spear-phish, spoofed sender] --> B[HTA/WSF stager]
    B --> C[JScript downloader RC4-decrypts 3 files]
    C --> D{BinaryFormatter deserialize}
    D -->|stage_1 fails| E[catch, try stage_2]
    D -->|stage_2| F[AxHost+State gadget loads TestAssembly.dll]
    F --> G[Fetch decoy + sideload bundle]
    G --> H[GatherOsState.exe sideloads slc.dll = Antino]
    H --> I[C2 via MS Graph: Outlook cmds, OneDrive heartbeat/files]

Preconditions / Affected

Windows hosts where mshta.exe/wscript can execute HTA/WSF attachments; .NET 4.x present for the BinaryFormatter gadget chain; environments where Microsoft 365/Graph traffic (graph.microsoft.com, login.microsoftonline.com) is allowed outbound, which the dead-drop C2 relies on to blend in.

What to do

Talos published ClamAV signatures (e.g., Html.Trojan.UAT-11587-10060367-2, Win.Trojan.UAT-11587-10060365-1 through -10060385-5) and Snort rules 1:66880, 1:66881, 1:66882 (both Snort 2 and 3). Hunt for the AssemblyAttribute GUID b2b3adb0-1669-4b94-86cb-6dd682ddbea3 in .NET binaries, the fixed tracking domain oisadjfoinsiduhfnoisdnfosdnoifnsoid[.]pages[.]dev, and sideload file naming patterns (GatherOsState.exe alongside slc.dll with unrelated extensions). Full IOC list is in Talos's GitHub repo referenced on the page.

Caveats

Talos assesses the CloudFront overlap with Arctic Wolf's UNC6384 infrastructure only at low confidence (cloud infra reuse is common), and explicitly could not independently verify any link between the espionage activity and Symantec's Jewelbug financially-motivated cluster — hence tracking UAT-11587 separately. The Scripted Diagnostics and sleep-mask techniques reduce but don't eliminate telemetry/detectability, per Talos's own wording.