Cisco Talos disclosed UAT-11587 on September 30, 2026, a newly tracked China-nexus espionage cluster targeting government, defense, diplomatic, policy and national-security organizations across Asia. This meets the watch threshold because UAT-11587 is a new vendor tracking designation, not simply a new campaign by an established APT. Cisco Talos Blog
| Intelligence field | Assessment |
|---|---|
| Actor | UAT-11587 |
| Possible overlap | Jewelbug activity; possible infrastructure overlap with UNC6384 |
| First observed | September 2025 |
| Public disclosure | September 30, 2026 |
| Nexus | China — Talos high confidence |
| Motivation | Intelligence collection / cyberespionage — moderate confidence |
| Observed activity | September 2025–July 2026 |
| Scale | ~350 compromised endpoints; at least 10 confirmed and five probable affected institutional environments |
| Countries | Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria |
| Primary malware | Antino |
| Attribution status | Separately tracked by Talos pending stronger evidence connecting it to another established actor |
Talos says its China-nexus assessment is based on the combined technical and operational evidence rather than a single artifact. Evidence includes Simplified Chinese (zh-CN) preparation metadata, UTC+8 timestamps, use of the China-oriented rsproxy.cn Rust package mirror, victimology aligned with Chinese intelligence interests, and infrastructure relationships. Talos assigns the China-nexus attribution high confidence. Cisco Talos Blog
Targeting
UAT-11587 concentrates on public-sector and national-security-adjacent organizations. Confirmed or probable targeting encompasses defense and military organizations, central government, foreign affairs and diplomatic services, justice and law enforcement, border/interior security, legislatures, government IT, universities, think tanks, civil society, human-rights groups and public-policy organizations. Talos assesses with moderate-to-high confidence that organizations in eight Asian/Middle Eastern countries were targeted. Cisco Talos Blog
The targeting and persistent information-collection capabilities lead Talos to assess with moderate confidence that UAT-11587 is conducting intelligence-gathering operations. Cisco Talos Blog
Antino backdoor
The most important newly documented capability is Antino, a previously undocumented Rust-compiled Windows backdoor supporting:
- Host reconnaissance
- Shell command execution
- PowerShell execution
- File upload/download
- In-memory shellcode execution
- Persistence
- Microsoft Graph API communications
- Outlook-based command exchange
- OneDrive-based heartbeat and file transfer
Most notably, Antino does not require a conventional dedicated C2 server for its native command channel. It uses Microsoft 365 applications as dead drops, with Outlook carrying commands and OneDrive supporting heartbeat and file-transfer operations. Cisco Talos Blog
Delivery and TTPs
UAT-11587 uses highly tailored spear-phishing. Talos observed fake Gmail attachment widgets embedded directly into malicious email HTML, sender spoofing exploiting envelope/header-domain differences, political and diplomatic decoys, Cloudflare Pages delivery, Cloudflare R2 payload staging and Amazon CloudFront-hosted content. Cisco Talos Blog
The recurring infection path is a five-stage chain beginning with HTA/WSF staging. Later stages abuse unsafe .NET BinaryFormatter deserialization before ultimately abusing the legitimate Microsoft-signed GatherOsState.exe binary to DLL-sideload Antino as slc.dll.
Relationship to other Chinese actors
There are two attribution relationships worth preserving separately in an intelligence database.
Jewelbug: Symantec independently published activity it calls Jewelbug. Talos found overlaps between Jewelbug and UAT-11587\'s Antino espionage activity. However, Talos could not independently verify the relationship between Jewelbug\'s reported financially motivated activity and this espionage operation, so it continues to track UAT-11587 separately. Cisco Talos Blog
UNC6384: UAT-11587 used the CloudFront distribution d32tpl7xt7175h[.]cloudfront[.]net, previously associated with China-nexus UNC6384 activity. Talos explicitly rates this relationship low confidence, noting that shared cloud infrastructure alone is insufficient to merge the clusters. Cisco Talos Blog
Intelligence assessment
Confirmed: UAT-11587 is a newly disclosed Talos activity cluster; Antino is its principal documented custom backdoor; activity dates to at least September 2025; the actor targeted government and national-security-related institutions across Asia. Cisco Talos Blog
High-confidence attribution: Talos assesses UAT-11587 as China-nexus with high confidence. Cisco Talos Blog
Moderate-confidence objective: Intelligence collection/cyberespionage. Cisco Talos Blog
Unresolved: UAT-11587 should not yet be merged with Jewelbug, UNC6384, or another established Chinese APT. The observed overlaps are insufficient, and Talos explicitly maintains UAT-11587 as a separate activity set. Cisco Talos Blog
Cisco Talos — UAT-11587 full technical report and IOC set, September 30, 2026
