China-Nexus UAT-11587 Uses Antino Backdoor for Cyber-Espionage

• •UAT-11587 targets government and policy organizations in Asia and the Middle East.
• •The Antino backdoor uses Microsoft 365 services for stealthy command-and-control.
• •Advanced techniques like DLL sideloading and social engineering are employed.

A newly identified cyber-espionage campaign attributed to the China-nexus group UAT-11587 is actively exploiting Microsoft 365 services, specifically Outlook and OneDrive, to deploy the Antino backdoor. This sophisticated attack targets government and policy organizations across Asia and the Middle East. The campaign utilizes multi-stage infection chains, including spear-phishing emails that deliver malicious payloads via trusted cloud services. The Antino backdoor, developed in Rust, allows for stealthy command-and-control operations by embedding malicious traffic within legitimate cloud activity. The threat actor employs advanced techniques such as DLL sideloading and social engineering to evade detection. Current mitigation strategies are being discussed to counteract this ongoing threat.