A fake Gmail attachment card linked policy-focused phishing to a Windows backdoor that takes orders through Outlook and moves files through OneDrive. In research published September 30, Cisco Talos says it identified about 350 compromised endpoints across eight countries by July 2026. Its tally covers at least 10 confirmed and five probable affected institutional environments, plus one additional intended target. Government, defense, diplomatic, research and civil-society organizations in Asia are the target set.
Talos tracks the actor as UAT-11587 and the Rust-compiled Windows backdoor as Antino. It assesses with high confidence that the activity is China-nexus, and with moderate confidence that the sustained targeting supports intelligence gathering. Talos observed activity from September 2025 through July 2026, including a June 8–9 wave of around 57 newly observed endpoints associated with India.
A forged attachment starts the chain
One Taiwan-directed message reconstructed Gmail’s attachment widget in HTML, using four inline images. The card was actually a link to an attacker-controlled Cloudflare Pages location with a per-recipient ?m= parameter. A recipient expecting a document could launch an HTA file instead. Talos also saw WSF stagers and a separate fake-installer branch, so the attachment-card path is a recurring delivery route rather than the whole campaign.
The message exploited a mail-authentication wrinkle. Migadu was allowed to send mail for the actor’s envelope domain osc-cdn[.]com, so SPF passed for that domain. The visible From header impersonated a trusted sender; DMARC failed alignment. The displayed domain’s p=none policy requested monitoring, and the message reached the inbox. An SPF pass for the envelope sender is a poor substitute for checking alignment with the visible sender.
In the HTA route, mshta.exe loads JScript from cloud infrastructure; a .NET deserialization stage runs a downloader in the script-host process. That downloader retrieves a decoy and a bundle including legitimate Microsoft-signed GatherOsState.exe and the malicious slc.dll. Running the signed binary from beside that DLL loads Antino through its SLOpen export. Cloudflare Pages and R2, and in some variants Amazon CloudFront, carry delivery or staging traffic; those shared services are infrastructure the actor abused, not attacker-owned domains to block wholesale.
Two Microsoft 365 dead drops
Antino’s command channel uses Microsoft Graph rather than a dedicated server. Its OneDrive path /antino/heartbeats/{id}.json receives a JSON host check-in on initial execution and roughly every minute. Files taken from victims go into /antino_downloads/{file} in the actor’s drive; /antino_uploads/{file} stages files to send toward victims. Those folder names describe the operator’s perspective. Talos says the file-based polling model helps “decouple operator activity from implant activity on the network.” Microsoft’s driveItem documentation describes files and folders as Graph drive items, which is why a normal-looking drive request can carry this traffic.
For tasking, the implant polls the actor’s Outlook mailbox about every 10 seconds. Subjects beginning command_req_ carry commands and command_res_ carry results keyed to a session ID. Talos describes capabilities including host inventory, file transfer, shell and PowerShell execution, in-memory shellcode loading and persistence. Its Gen2 build uses OAuth client credentials, an application-only flow to access the configured Outlook mailbox and OneDrive resources without an interactive user sign-in. Network connections to graph.microsoft.com and login.microsoftonline.com therefore blend with ordinary Microsoft 365 traffic. These are legitimate shared-service hostnames; investigate the process making the requests rather than blocking all Microsoft Graph access.
The actor’s mailbox and drive are on the other side of those Graph requests. Microsoft lists service-principal sign-ins alongside interactive and non-interactive user sign-ins in a tenant’s Entra logs. Review those logs for suspicious applications registered in your own tenant, but use endpoint process and network telemetry to hunt Antino contacting an actor-controlled tenant. The user’s sign-in view alone misses application-only authentication.
Windows artifacts locate the implant
Start with mail and endpoint events for people who received policy, maritime or government-themed lures. Correlate an HTML attachment-card click or an HTA/WSF download with mshta.exe or Windows Script Host starting on that workstation. Talos repeatedly saw the tracking hostname oisadjfoinsiduhfnoisdnfosdnoifnsoid[.]pages[.]dev in HTA variants. The TestAssembly.dll downloader builds Talos recovered shared assembly GUID b2b3adb0-1669-4b94-86cb-6dd682ddbea3.
Then inspect launches of GatherOsState.exe from writable locations alongside slc.dll, especially under %LOCALAPPDATA%\Windows GatherOSStateKit\. That path is one Antino persistence location; configurations with run set to true stage files there and create an HKCU\Software\Microsoft\Windows\CurrentVersion\Run value. Talos also traced PowerShell execution through the Windows diagnostic host sdiagnhost.exe, with working directories such as C:\Windows\Temp\SDIAG_<GUID> and a result.ps1 script. Correlate file creation, Run-key changes, diagnostic-host execution and Graph-bound connections by host and time. A signed Windows host in that sequence is still part of the investigation.
Talos and Symantec use different actor tracking: Talos retains UAT-11587 as a separate cluster from Symantec’s Jewelbug. Talos found overlaps with Antino-related espionage but could not independently verify a link to the financially motivated activity Symantec described. Prioritize the observable loader and implant behavior over assuming one actor label covers every intrusion.
Remove the script-host entry route
On workstations that have no business need to run downloaded HTA or WSF content, enforce an application-control policy that blocks that execution path, and test it against your approved workflows. For the reported sender-spoofing route, review DMARC failures against the visible From domain and move domains you control toward an enforcing policy after validating legitimate mail.
For an endpoint that matches the script-host, signed-binary/DLL or persistence sequence, isolate it and investigate the related accounts and file access. Remove the implant and its Run entry through your incident-response process, then verify on the recovered host that slc.dll and the suspect Run value are gone, downloaded HTA/WSF execution is blocked, and the prior process-to-Graph connection pattern has stopped. Graph’s shared endpoints alone are too broad for that check; the Windows process chain is where this operation becomes distinguishable.