UAT-11587 Deploys Antino Backdoor Against Asian Government and Policy Targets

En bref

• Cisco Talos attributes a campaign to UAT-11587.
• The intruders use Antino malware to maintain a backdoor.
• Targets include government agencies and policy organizations.
• Activity spans Taiwan, India, the Philippines, and Cambodia.
• No CVE is tied to the campaign; severity is medium.

Cisco Talos has exposed a cluster it tracks as UAT-11587, tying the group to intrusions that rely on a malware family named Antino. The operations are aimed at public-sector agencies and think-tank-style policy bodies, with activity observed across multiple Asian locations: Taiwan, India, the Philippines, and Cambodia.

According to Talos, the adversary's tradecraft includes initial targeting, then delivering a backdoor, and conducting discovery on victim networks. No CVE identifiers are associated with this campaign in the provided facts, so exploitation of a specific software flaw is not the known entry point. The result is a medium-severity threat: not mass ransomware, but a focused espionage-style risk to organizations that hold sensitive policy and citizen data.

Who is affected? Government offices and policy-focused groups in the named countries should treat this as a credible threat. Because the actor performs discovery after gaining access, defenders should assume that any successful intrusion could lead to broader mapping of systems, user accounts, and data stores.

Why it matters: public institutions are attractive targets for intelligence collection, and a backdoor can provide persistent access that outlasts a single phishing wave. Even without a named CVE, the combination of targeted delivery and post-compromise reconnaissance gives UAT-11587 room to operate quietly.

What to watch: Talos reporting may add indicators, command-and-control details, or revised victimology. Until then, teams in the affected regions should monitor for Antino-related artifacts, unusual outbound traffic, and reconnaissance behavior such as rapid enumeration of shares, accounts, and directory services.

À faire maintenant

1. Hunt endpoint, proxy, and DNS logs for Antino artifacts and UAT-11587 activity; isolate confirmed compromises.
2. Restrict outbound access from sensitive networks to approved destinations; flag unusual long-running sessions.
3. Enforce phishing-resistant MFA for email, VPN, and privileged accounts at government and policy entities.
4. Patch and harden internet-facing services promptly, even without a linked CVE.
5. Segment networks and audit directory permissions to limit discovery and lateral movement.
6. Increase logging for identity, file-share, and endpoint events; centralize alerts in the SIEM.
7. Train staff on targeted phishing and credential theft; make reporting suspicious messages easy.

Source originale

Cisco Talos