Cisco Talos has published a detailed report on UAT-11587, a China-nexus threat cluster that has targeted government and policy organizations across Asia with a previously undocumented Windows backdoor called Antino. The Hacker News covered the findings on October 2. Talos first saw the cluster's activity in September 2025 and, by July 2026, had identified at least 16 affected or targeted institutional environments across eight countries, with roughly 350 compromised endpoints. Two details stand out for anyone who runs their own mail or manages their own network. The backdoor takes its commands through Microsoft 365 services that most networks allow by default, and one spoofed phishing email Talos examined was delivered even though it failed a DMARC check.
How the Spoofed Email Got Through
Talos says UAT-11587 wanted its spear-phishing emails to look like they came from organizations the targets already trusted, so it spoofed those senders. The trick relies on the fact that an email carries two sender identities. The envelope sender is used behind the scenes to route mail, while the From header is what the recipient actually sees. In the message Talos reviewed, the envelope sender was an attacker-controlled domain, osc-cdn[.]com, sent through the Migadu mail service, while the From header showed the organization being impersonated.
That split explains the result. SPF passed, because Migadu was authorized to send for the attacker's own domain, but the check only covers the envelope domain and says nothing about the name the reader sees. DMARC caught the mismatch and reported a failure. The catch was the impersonated domain's policy, which was set to p=none, a monitoring-only setting that asks receivers to take no action. The receiving provider, which Talos does not name, therefore delivered the message to the inbox.
For a domain owner, that policy is a decision made in DNS, not something a mail provider makes for you. Cloudflare's guide says owners have to configure these records themselves, that web hosts do not necessarily do it automatically, and that even domains which never send mail should publish a DMARC record so nobody can pretend to send from them. Moving from monitoring to quarantine or reject has its own risk, since legitimate mail from a forgotten sender can get blocked, which is the reason DMARC reports exist. Self-hosters are in this position by definition. Mailu, the Docker-based mail server stack, lists DKIM signing, SPF, and DMARC among the standards it supports, but the records and the policy behind them are still the administrator's to set.
The email itself was built to look routine. According to Talos, the actor recreated Gmail's attachment card inside the HTML body using four inline PNG images, then wrapped the whole card in a link to a Cloudflare Pages address. When a Gmail user opens the message in a browser, Gmail renders the HTML as written, so the fake card looks like a genuine attachment preview. The link used a protocol-relative address starting with //, which Talos says may be missed by tools that only extract full http or https links, and it carried a per-recipient identifier so the operators could log who clicked.
A Command Channel Built From Services Most Networks Allow
Once a victim clicks, Talos describes a five-stage chain. The link downloads an HTA or WSF script, which fetches a JavaScript downloader and decryptor. That stage triggers a .NET deserialization chain that loads a small downloader called TestAssembly.dll, which opens a decoy document for the victim and then downloads and launches the backdoor. The backdoor, slc.dll, is started through DLL sideloading by GatherOsState.exe, a legitimate Microsoft-signed binary from the Windows Assessment and Deployment Kit. Much of the delivery runs on Cloudflare Pages and R2 storage plus Amazon CloudFront, which keeps the early traffic inside ordinary HTTPS to widely used cloud services.
Antino itself is a Rust-compiled backdoor that can run cmd.exe and PowerShell commands, list directories, transfer files, run shellcode in memory, and add itself to the Registry Run key for persistence. What makes it unusual is how it talks to its operators. Instead of calling a dedicated command server, it uses the Microsoft Graph API to reach the operator's own Outlook mailbox and OneDrive. The implant checks the mailbox every 10 seconds for messages whose subject starts with command_req_ followed by a session ID, and answers with matching command_res_ messages. OneDrive carries a heartbeat file that is re-uploaded every minute, plus folders for files pulled from victims and tools pushed to them. In the newer builds, Talos says authentication uses the OAuth 2.0 client-credentials flow through a registered Entra ID application, so no interactive sign-in is needed.
The traffic ends at graph.microsoft.com and login.microsoftonline.com, two hosts Talos describes as widely trusted and commonly allowed in enterprise environments. That is the point of the design: at the network layer, the backdoor's traffic blends into normal Microsoft application sync.
Where Self-Hosted and Hardening Tools Fit
Talos's report is about indicators and detection, and it does not test or recommend any of the tools below. What follows is general background on where tools we list line up with the weak points this campaign exposes.
The first is outbound control on Windows. A rule set built around trusted domains treats Microsoft's own hosts as safe, which is the gap Antino uses, while a rule set built around which program may reach the internet works from the other side. Fort Firewall supports per-application rules, parent-process-based rules, and a stricter block-if-not-allowed mode, and SimpleWall offers a lightweight interface to the Windows Filtering Platform for blocking unwanted outbound connections. Because a sideloaded DLL runs inside the process that loads it, the backdoor's traffic would be expected to appear as coming from GatherOsState.exe, a deployment-kit binary with no ordinary reason to talk to Microsoft Graph. Under a deny-unless-allowed rule set, that connection would be blocked by default. Talos also describes standalone Antino executables delivered through fake installer sites, and a per-program rule does nothing if the program already has permission to connect. Organizations that do not use Microsoft 365 at all have a simpler option, which is to block those two Microsoft hostnames at the network edge, though Talos does not make that recommendation and it would break any legitimate use of them.
The second is isolation. The delivery chain Talos documents leans on Windows components throughout, including mshta.exe, .NET deserialization, and the Windows Scripted Diagnostics framework, and the report covers only Windows. Qubes OS takes a different approach, isolating applications into separate virtual machines so that a compromised app does not take the rest of the system with it. Keeping email and document handling in a separate qube would not stop anyone from being phished, but it changes what a successful phish can reach. Talos lists civil society, human rights, think tank, and university targets alongside government agencies, so individual researchers and activists are part of the audience for that kind of setup.
What This Doesn't Change
This is a targeted espionage campaign, not a mass-market threat. Talos assesses with high confidence that the actor is China-nexus and with moderate confidence that the goal is intelligence gathering. The lures were tailored, ranging from Taiwanese legislative tax rules to a CSIS Indo-Pacific event to a news-style headline, which suggests the operators researched their targets first.
The design also has limits. Talos notes that running PowerShell through the Windows Scripted Diagnostics framework can make attribution to the implant harder, but it does not erase the PowerShell, file-creation, and Registry activity that defenders can still see. Talos has published ClamAV signatures, Snort rules, and a list of indicators on GitHub, including the backdoor loading through GatherOsState.exe and a persistent copy staged in a folder named Windows GatherOSStateKit under the user's local app data.
For ordinary readers, the most practical lesson is in the email header. Cloudflare notes that most mail clients have a Show details or Show original option where the SPF, DKIM, and DMARC results appear. In this campaign, a lone spf=pass would have been misleading, because it covered the attacker's envelope domain and not the sender shown on screen. The DMARC line is the one that compares against the visible From address.
Sources
- Cisco Talos, "China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor," September 30, 2026: blog.talosintelligence.com
- The Hacker News, "Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign," October 2, 2026: thehackernews.com
- Cloudflare Learning Center, "What are DMARC, DKIM, and SPF?": cloudflare.com
- Cisco Talos indicators of compromise for UAT-11587: github.com/Cisco-Talos/IOCs
This article was written by DigitalEscapeTools based on reporting and research from Cisco Talos, The Hacker News, and Cloudflare, the tool listings on this site, and publicly available information at the time of publication.
