Actor Profile

UAT-11587 is a China-nexus threat actor tracked by Cisco Talos, first detected in September 2025 targeting Taiwan's academic, think tank, and civil society policy community. The actor is assessed to share tactical overlap with Jewelbug, CL-STA-0049, Earth Alux, Ink Dragon, and REF7707, though Talos designates it as a separate activity set due to lack of evidence linking it to Jewelbug's financially motivated cryptocurrency fraud operations. Attribution to China is made with high confidence based on zh-CN language artifacts, Simplified Chinese metadata in lure documents, UTC+08:00 time zone in phishing headers, use of rsproxy[.]cn Cargo registry paths (a mainland China mirror service), and targeting patterns consistent with Chinese state interests. The actor demonstrates sophisticated reconnaissance capabilities and operational security, conducting espionage operations focused on foreign affairs, international security, and government policy intelligence collection.

TTPs (Tactics, Techniques, Procedures)

Initial access via spear-phishing with spoofed sender identities to bypass SPF/DMARC checks. Social engineering includes fake Gmail attachment preview widgets embedded in HTML using Base64-encoded PNG images, linking to attacker-controlled Cloudflare Pages URLs. Five-stage infection chain: HTA/WSF stager downloads JavaScript downloader/decryptor, triggers .NET deserialization chain to load TestAssembly.dll, which downloads lure document and decoy Calculator.exe while deploying Antino backdoor via DLL sideloading using legitimate Microsoft-signed GatherOsState.exe. Antino backdoor performs host reconnaissance, shell/PowerShell execution, file transfer, in-memory shellcode loading, and establishes persistence. C2 communications operate exclusively through Microsoft 365 using Microsoft Graph API to interact with Outlook and OneDrive as dead drops, avoiding traditional C2 infrastructure. Infrastructure overlap includes CloudFront domain d32tpl7xt7175h[.]cloudfront[.]net previously associated with UNC6384 campaigns.

Targets & Patterns

Primary targets are government and policy organizations across Asia, with 16 entities compromised across eight countries: Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and China. Specific focus on Taiwan's political, legislative, civil defense, and policy research sectors, plus regional government, maritime, diplomatic, and security organizations. Evidence indicates expansion to Syrian organizations around May 2026, suggesting broader geographic ambitions beyond Asia. Targeting patterns align with Chinese state intelligence collection priorities on regional security, foreign policy, and diplomatic affairs. Attack tempo spiked between March and early June 2026, with concentrated waves on June 8-9, 2026 targeting dozens of systems in government IT infrastructure. Lure themes demonstrate extensive pre-operational reconnaissance tailored to audiences interested in foreign affairs, international security, and government policy.

Historical Context

UAT-11587 activity was first detected in September 2025 with spear-phishing against Taiwan's academic and policy community. The campaign expanded significantly through 2026, with peak activity March-June 2026. Talos assesses tactical overlap with Jewelbug (characterized by Symantec/Carbon Black in August 2026 as China-based hackers-for-hire conducting espionage and cryptocurrency fraud), as well as clusters CL-STA-0049, Earth Alux, Ink Dragon, and REF7707. However, Talos found no evidence linking UAT-11587 to Jewelbug's financially motivated operations, warranting separate tracking. Infrastructure overlap exists with UNC6384 (Arctic Wolf reporting), a China-affiliated actor that targeted European diplomatic and government entities using unpatched Windows shortcut vulnerabilities. The Antino backdoor represents a previously undocumented tool first observed in this campaign.

Defensive Recommendations

  • Implement strict email authentication controls (SPF, DMARC, DKIM) and monitor for sender identity spoofing attempts targeting trusted organizational contacts
  • Deploy behavioral detection for Microsoft Graph API abuse, specifically monitoring unusual Outlook and OneDrive access patterns that may indicate C2 dead drop activity
  • Monitor for DLL sideloading activity involving legitimate Microsoft-signed binaries (e.g., GatherOsState.exe) loading unexpected DLLs from non-standard paths
  • Detect .NET deserialization attacks and multi-stage JavaScript/HTA/WSF execution chains, particularly those downloading payloads from Cloudflare Pages or CloudFront domains
  • Hunt for Rust-compiled Windows executables with Cargo registry paths referencing rsproxy[.]cn and inspect artifacts containing zh-CN language or Simplified Chinese metadata in policy/government environments

---

# Geopolitical Context

Geopolitical Context

A China-nexus threat actor, tracked as UAT-11587, is conducting a sustained espionage campaign against government and policy organizations across Asia, with particular focus on Taiwan's political, legislative, and civil defense sectors. The campaign, first detected in September 2025, has expanded to target 16 entities across eight Asian countries including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. The targeting pattern and lure themes—encompassing Taiwanese political subjects, regional maritime affairs, and diplomatic security—are consistent with strategic intelligence collection priorities associated with China-aligned actors. The operation demonstrates sophisticated reconnaissance and social engineering, including sender identity spoofing and Gmail widget replication to bypass email security controls. The threat actor is assessed with high confidence to be China-nexus based on zh-CN language artifacts, Simplified Chinese metadata, UTC+08:00 time zones, and use of mainland China-specific development infrastructure (rsproxy.cn). While UAT-11587 exhibits tactical overlaps with known China-aligned clusters including Jewelbug, CL-STA-0049, Earth Alux, Ink Dragon, and REF7707, researchers have not established definitive organizational links, particularly to Jewelbug's financially motivated cryptocurrency operations.

State Actor Alignment

The campaign is attributed with high confidence to a China-nexus threat actor based on multiple technical and contextual indicators: language artifacts (zh-CN, Simplified Chinese), time zone metadata (UTC+08:00), use of China-domestic development infrastructure (rsproxy.cn mirror service), and targeting priorities aligned with Chinese strategic interests in the Asia-Pacific region. The actor demonstrates tactical similarities with established China-aligned clusters (CL-STA-0049, Earth Alux, Ink Dragon, REF7707) and possible overlap with Jewelbug, though definitive organizational attribution remains uncertain. The targeting of Taiwan's political and civil defense sectors, alongside regional government and diplomatic entities, reflects collection priorities consistent with state-sponsored intelligence operations rather than financially motivated cybercrime. No specific sanctions or policy responses are mentioned in the reporting, though the use of legitimate Microsoft 365 infrastructure for command and control may complicate attribution and interdiction efforts by Western governments.

Business Impacty pro region

The campaign represents a significant escalation in China-nexus cyber espionage across the Indo-Pacific region, with implications for regional security and diplomatic relations. Taiwan emerges as a primary target, with focused collection against political, legislative, civil defense, and policy research institutions—consistent with Beijing's strategic interest in cross-Strait affairs and Taiwan's domestic political landscape. The expansion to India, the Philippines, and other Southeast Asian nations (Cambodia, Pakistan, Thailand, Myanmar) suggests broad intelligence gathering on regional government positions, maritime affairs, and diplomatic activities, likely related to South China Sea disputes, Belt and Road Initiative engagement, and regional alliance dynamics. The brief targeting of Syrian organizations in May 2026 indicates potential interest in Middle Eastern affairs, possibly related to China's economic interests or diplomatic positioning. For European and Western allies, the campaign underscores the persistent threat to partner nations in Asia and the need for coordinated cyber defense and information sharing. The concentrated attack wave in June 2026 targeting government IT infrastructure suggests operational tempo aligned with specific geopolitical events or intelligence requirements during that period.

Forecast

If UAT-11587 maintains current operational patterns, targeting of Asian government and policy organizations is likely to continue through 2026 and into 2027, with Taiwan remaining a priority collection target given ongoing cross-Strait tensions. The threat actor's demonstrated ability to conduct extensive reconnaissance and tailor social engineering lures suggests future campaigns will likely feature increasingly sophisticated initial access techniques. If Microsoft implements detection or mitigation measures for the Outlook/OneDrive command-and-control technique, the actor may pivot to alternative legitimate cloud services to maintain operational security. Should geopolitical tensions escalate in the Taiwan Strait or South China Sea, targeting intensity against regional diplomatic and defense entities would likely increase correspondingly. Organizations in the identified target countries that enhance email security controls (SPF/DMARC enforcement, attachment sandboxing) may reduce successful initial access, potentially forcing the actor to diversify infection vectors. If Western governments attribute this activity more definitively to Chinese state apparatus and impose diplomatic or economic costs, operational tempo may temporarily decrease, though strategic collection priorities would likely remain unchanged. The expansion to Syria suggests the actor's mandate may broaden to include Middle Eastern targets if Chinese strategic interests in that region continue to grow.