China-linked Cyber-Espionage Campaign Targets Asia and Middle East with Rust-based Backdoor
A cyber-espionage campaign linked to China is exploiting a Rust-based backdoor, Antino, against organizations in Asia and the Middle East. The campaign, attributed to UAT-11587, uses advanced social engineering and targets various sectors.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
A China-nexus cyber-espionage campaign using a Rust-based backdoor, Antino.
Who is affected
Government, defense, policy organizations in Asia and the Middle East.
Exploited
Confirmed exploitation in the wild.
What to do
Defenders advised to monitor unusual mshta.exe or Windows Script Host activity.
A China-nexus cyber-espionage campaign is actively exploiting a sophisticated Rust-based backdoor named Antino. This campaign is attributed to the group UAT-11587 and targets government, defense, and policy organizations across Asia and the Middle East.
The campaign has been active since at least September 2025 and has compromised over 350 endpoints across at least 16 organizations. Victims include government agencies, defense organizations, diplomatic services, and universities.
The Antino backdoor employs Microsoft Outlook and OneDrive as covert command-and-control channels, utilizing the Microsoft Graph API to interact with attacker-controlled Outlook mailboxes and OneDrive storage.
The infection chain begins with highly targeted spear-phishing emails, and Antino supports a wide range of post-exploitation capabilities, including arbitrary command execution and file upload/download.
The campaign's geographic focus includes Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. Attack waves have been observed to coincide with regional political events.
Defenders are advised to monitor unusual mshta.exe or Windows Script Host activity as part of their security measures.
Rescana: Active Exploitation Alert: China-Nexus UAT-11587 Deploys Antino Backdoor Leveraging Microsoft 365 Outlook and OneDrive for Stealthy Cyber-Espionage in Asia and Middle East
