China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

    Date: 10/01/2026

    Severity: High

    Summary

    Identified UAT-11587 targeting government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia. First observed in September 2025, the activity had affected or targeted at least 16 institutional environments across eight Asian countries by July 2026. The campaign uses “Antino,” a Rust-based Windows backdoor capable of reconnaissance, command execution, file transfer, shellcode loading, and persistence. The attack chain begins with spear-phishing and decoy documents, using Cloudflare infrastructure for delivery, tracking, and payload staging. Based on development, infrastructure, and targeting indicators, Talos assesses with high confidence that UAT-11587 is China-nexus.

    Indicators of Compromise (IOC) List

    Domains/URLs

    osc-cdn.com

    oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages.dev

    d2nq35tel3ucuo.cloudfront.net

    pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev

    pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev

    my-3lyt6wcp.pages.dev

    my-qc39r814.pages.dev

    my-662ylt3w.pages.dev

    my-6g16qsfe.pages.dev

    my-goq6xmbm.pages.dev

    my-h3qli6kq.pages.dev

    my-sv7c1fzs.pages.dev

    my-u0up9qri.pages.dev

    my-vtsdod2n.pages.dev

    my-wgoxp32b.pages.dev

    microsoft-flash.com

    wps-cn.com

    https://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe

    https://www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe

    https://my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.hta

    https://my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.wsf

    https://my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.hta

    https://my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.wsf

    https://my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta

    https://my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.wsf

    https://my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.hta

    https://my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.wsf

    https://my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.hta

    https://my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.wsf

    https://my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.hta

    https://my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.wsf

    https://my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.hta

    https://my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.wsf

    https://my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.hta

    https://my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.wsf

    http://d2nq35tel3ucuo.cloudfront.net/4oyE4n4ozLQ0.log

    http://d2nq35tel3ucuo.cloudfront.net/LtVGUSsyUTDA.log

    http://d2nq35tel3ucuo.cloudfront.net/TzzyYlYnJ40Z.log

    http://d2nq35tel3ucuo.cloudfront.net/tdyvHHVcrci8.log

    http://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/Qw7Womin4X6N

    http://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/kVFPxm1uAjOY

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5SVIdjpRQjkZ

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/PbyfSk69AwVf

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/qMD71Z95clTf

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/HenUWB51MwpG

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/q9LgxIaU1CJK

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/BKvYRxPiGpbM

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/nswz3cb9lhuC

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/6HJV5qV5BTLs

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/MKJacn3hFt3Y

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/cX8MChhuVvzz

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/byrdvvZEZZlk

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5TGrbjCCLa8M

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/s0p18dgHR4PZ

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/zlKDeyO3HuUS

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/icWMOGLJcfQO

    http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5U7kzhvlYlVF

    https://d2nq35tel3ucuo.cloudfront.net/9q9OlLKCm0an2ct1.js

    https://d2nq35tel3ucuo.cloudfront.net/LwqPW64Xl0ti3q7s.txt

    https://d2nq35tel3ucuo.cloudfront.net/HsOw0YU9s11dxyr1.txt

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/0u25lAqY58or53ra.js

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/gpv0IRMtvto6e8t2.txt

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HzjNPgRE9ir92e38.txt

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/2laZiB2zvnx04jze.js

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/wyLwwCu43j1wf2pg.js

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/ThyI9pwewrh_a1pr.txt

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/8ypvQLxJvggmrz94.txt

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/vD68BdmB2ky28gcc.js

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/oaFE7PJHk0h_emqt.txt

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/AcPP9fCvdjztmho8.txt

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/7ChyKauxbnuftp68.js

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/KOOOT4a76st012bx.txt

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/Ub4RJzNIrfleri8t.txt

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6ZGatherOsState.exe.luy

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6Zslc.dll.pzs

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6ZOsGather.dat.syk

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgGatherOsState.exe.lzj

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgslc.dll.iwq

    https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgOsGather.dat.ael

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPGatherOsState.exe.thl

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPslc.dll.czh

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPOsState.dat.mxb

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3WxnGatherOsState.exe.mtm

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3Wxnslc.dll.fsc

    https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3WxnOsState.dat.pgy

    IP Address

    103.27.110.220

    Hash

    e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34

    e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf

    4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f

    f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8

    01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a

    5a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d839562

    17b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4b

    484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c6506

    3a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02a

    6a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56

    75c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513c

    bd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4

    b75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6

    23d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3ac

    0b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc739

    ae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585e

    cd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7

    b8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655

    7969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b838

    aea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90

    7fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e32

    65f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe6770295788

    61a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da0

    747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d533

    a13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dc

    2f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05

    a0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221

    47f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2

    b3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731

    0a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec4970

    f0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97

    5555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db55041

    5168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005ca

    7c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395c

    d87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3e

    334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100c

    077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1

    ad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670

    e2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3f

    3a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2af

    4b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008b

    c8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50

    079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da5027513

    8e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75f

    170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a464

    b31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40

    d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf

    133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098

    9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f

    d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a

    131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46

    09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff

    0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd

    1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da

    40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d

    5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb

    971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d

    9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3

    b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e

    ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800

    e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530

    e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb

    fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "osc-cdn.com" or url like "osc-cdn.com" or siteurl like "osc-cdn.com" or domainname like "oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages.dev" or url like "oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages.dev" or siteurl like "oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages.dev" or domainname like "d2nq35tel3ucuo.cloudfront.net" or url like "d2nq35tel3ucuo.cloudfront.net" or siteurl like "d2nq35tel3ucuo.cloudfront.net" or domainname like "pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev" or url like "pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev" or siteurl like "pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev" or domainname like "pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev" or url like "pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev" or siteurl like "pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev" or domainname like "my-3lyt6wcp.pages.dev" or url like "my-3lyt6wcp.pages.dev" or siteurl like "my-3lyt6wcp.pages.dev" or domainname like "my-qc39r814.pages.dev" or url like "my-qc39r814.pages.dev" or siteurl like "my-qc39r814.pages.dev" or domainname like "my-662ylt3w.pages.dev" or url like "my-662ylt3w.pages.dev" or siteurl like "my-662ylt3w.pages.dev" or domainname like "my-6g16qsfe.pages.dev" or url like "my-6g16qsfe.pages.dev" or siteurl like "my-6g16qsfe.pages.dev" or domainname like "my-goq6xmbm.pages.dev" or url like "my-goq6xmbm.pages.dev" or siteurl like "my-goq6xmbm.pages.dev" or domainname like "my-h3qli6kq.pages.dev" or url like "my-h3qli6kq.pages.dev" or siteurl like "my-h3qli6kq.pages.dev" or domainname like "my-sv7c1fzs.pages.dev" or url like "my-sv7c1fzs.pages.dev" or siteurl like "my-sv7c1fzs.pages.dev" or domainname like "my-u0up9qri.pages.dev" or url like "my-u0up9qri.pages.dev" or siteurl like "my-u0up9qri.pages.dev" or domainname like "my-vtsdod2n.pages.dev" or url like "my-vtsdod2n.pages.dev" or siteurl like "my-vtsdod2n.pages.dev" or domainname like "my-wgoxp32b.pages.dev" or url like "my-wgoxp32b.pages.dev" or siteurl like "my-wgoxp32b.pages.dev" or domainname like "microsoft-flash.com" or url like "microsoft-flash.com" or siteurl like "microsoft-flash.com" or domainname like "wps-cn.com" or url like "wps-cn.com" or siteurl like "wps-cn.com" or domainname like "microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe" or url like "microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe" or siteurl like "microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe" or domainname like "www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe" or url like "www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe" or siteurl like "www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe" or domainname like "my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.hta" or url like "my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.hta" or siteurl like "my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.hta" or domainname like "my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.wsf" or url like "my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.wsf" or siteurl like "my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.wsf" or domainname like "my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.hta" or url like "my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.hta" or siteurl like "my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.hta" or domainname like "my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.wsf" or url like "my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.wsf" or siteurl like "my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.wsf" or domainname like "my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta" or url like "my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta" or siteurl like "my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta"

    Detection Query 2 :

    domainname like "my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.wsf" or url like "my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.wsf" or siteurl like "my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.wsf" or domainname like "my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.hta" or url like "my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.hta" or siteurl like "my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.hta" or domainname like "my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.wsf" or url like "my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.wsf" or siteurl like "my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.wsf" or domainname like "my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.hta" or url like "my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.hta" or siteurl like "my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.hta" or domainname like "my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.wsf" or url like "my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.wsf" or siteurl like "my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.wsf" or domainname like "my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.hta" or url like "my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.hta" or siteurl like "my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.hta" or domainname like "my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.wsf" or url like "my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.wsf" or siteurl like "my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.wsf" or domainname like "my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.hta" or url like "my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.hta" or siteurl like "my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.hta" or domainname like "my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.wsf" or url like "my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.wsf" or siteurl like "my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.wsf" or domainname like "my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.hta" or url like "my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.hta" or siteurl like "my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.hta" or domainname like "my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.wsf" or url like "my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.wsf" or siteurl like "my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.wsf"

    Detection Query 3 :

    sha256hash IN ("e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34","e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf","4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f","f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8","01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a","5a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d839562","17b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4b","484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c6506","3a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02a","6a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56","75c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513c","bd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4","b75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6","23d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3ac","0b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc739","ae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585e","cd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7","b8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655","7969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b838","aea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90","7fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e32","65f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe6770295788","61a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da0","747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d533","a13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dc","2f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05","a0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221","47f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2","b3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731","0a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec4970","f0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97","5555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db55041","5168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005ca","7c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395c","d87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3e","334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100c","077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1","ad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670","e2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3f","3a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2af","4b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008b","c8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50","079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da5027513","8e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75f","170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a464","b31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40","d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf","133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098","9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f","d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a","131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46","09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd","1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da","40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb","971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d","9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3","b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e","ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800","e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530","e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb","fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1")

    Reference: 

    https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/

    Tags : Malware, Threat Actor, Backdoor, China-Nexus, Asia, Government Services and Facilities, Taiwan, India, the Philippines, Cambodia, Rust malware, Shellcode, Phishing, Spear-Phishing, Cloudflare infrastructure, China

     


    Tags

    MalwareThreat ActorBackdoorChina-NexusAsiaGovernment Services and FacilitiesTaiwanIndiathe PhilippinesCambodiaRust MalwareShellcodePhishingSpear PhishingCloud InfrastructureChina

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags