🎯 Abuse of Windows Scripted Diagnostics framework

The items that name it 2

• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
  writeup2026-09-30

  Antino's execute_program and add_to_run commands create CScriptedDiag COM instance (CLSID {1F3D8AA5-9EBF-4EE4-85C2-EA40379AEDE8}) via sdiageng.dll with blank PCW package, writes attacker PowerShell into temp working directory, execution delegated to sdiagnhost.exe -Embedding to proxy PowerShell exec

• Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
  article

  Antino abuses the Windows Scripted Diagnostics framework to execute attacker-controlled PowerShell through legitimate Windows components, complicating behavioral attribution though not eliminating PowerShell, file-creation, or Registry telemetry.