Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
129 IOCs
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
Threat Actors
Malware Families
Excerpt
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts.  Talos first observed UAT-11587 activity in September 2025. By July 2026, Talos had identified at least 16 affected or targeted institutional environments across eight Asian…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →129 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd | High | Score 86/100 | First seen |
| URL | http://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/Qw7Womin4X6N | High | Score 58/100 | First seen |
| Domain | page.dev | High | Score 58/100 | First seen |
| SHA256 | 131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46 | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPOsState.dat.mxb | High | Score 58/100 | First seen |
| SHA256 | 1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da | High | Score 86/100 | First seen |
| URL | https://my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.hta | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/8ypvQLxJvggmrz94.txt | High | Score 58/100 | First seen |
| SHA256 | 8e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75f | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/nswz3cb9lhuC | High | Score 58/100 | First seen |
| URL | https://my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.wsf | High | Score 58/100 | First seen |
| Domain | wps-cn.com | High | Score 58/100 | First seen |
| SHA256 | 5168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005ca | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5U7kzhvlYlVF | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPGatherOsState.exe.thl | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/qMD71Z95clTf | High | Score 58/100 | First seen |
| SHA256 | 484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c6506 | High | Score 58/100 | First seen |
| SHA256 | 7c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395c | High | Score 58/100 | First seen |
| SHA256 | 5555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db55041 | High | Score 58/100 | First seen |
| SHA256 | 61a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da0 | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5TGrbjCCLa8M | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/zlKDeyO3HuUS | High | Score 58/100 | First seen |
| SHA256 | 65f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe6770295788 | High | Score 58/100 | First seen |
| SHA256 | b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e | High | Score 58/100 | First seen |
| SHA256 | 4b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008b | High | Score 58/100 | First seen |
| SHA256 | 5a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d839562 | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgslc.dll.iwq | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/cX8MChhuVvzz | High | Score 58/100 | First seen |
| URL | https://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe | High | Score 58/100 | First seen |
| SHA256 | e2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3f | High | Score 58/100 | First seen |
| SHA256 | b31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40 | High | Score 58/100 | First seen |
| SHA256 | d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf | High | Score 58/100 | First seen |
| URL | http://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/kVFPxm1uAjOY | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6ZGatherOsState.exe.luy | High | Score 58/100 | First seen |
| SHA256 | 334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100c | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3WxnGatherOsState.exe.mtm | High | Score 58/100 | First seen |
| SHA256 | b3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731 | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HzjNPgRE9ir92e38.txt | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/6HJV5qV5BTLs | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3Wxnslc.dll.fsc | High | Score 58/100 | First seen |
| URL | https://my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.hta | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/PbyfSk69AwVf | High | Score 58/100 | First seen |
| SHA256 | e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf | High | Score 72/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/2laZiB2zvnx04jze.js | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6ZOsGather.dat.syk | High | Score 58/100 | First seen |
| URL | https://my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/HenUWB51MwpG | High | Score 58/100 | First seen |
| SHA256 | 01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPslc.dll.czh | High | Score 58/100 | First seen |
| SHA256 | f0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97 | High | Score 58/100 | First seen |
| SHA256 | c8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50 | High | Score 58/100 | First seen |
| SHA256 | ad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670 | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/oaFE7PJHk0h_emqt.txt | High | Score 58/100 | First seen |
| SHA256 | 3a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2af | High | Score 58/100 | First seen |
| SHA256 | 079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da5027513 | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgOsGather.dat.ael | High | Score 58/100 | First seen |
| SHA256 | 4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f | High | Score 58/100 | First seen |
| SHA256 | 0a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec4970 | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/icWMOGLJcfQO | High | Score 58/100 | First seen |
| URL | https://my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.wsf | High | Score 58/100 | First seen |
| SHA256 | d87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3e | High | Score 58/100 | First seen |
| SHA256 | a13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dc | High | Score 58/100 | First seen |
| SHA256 | 17b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4b | High | Score 58/100 | First seen |
| SHA256 | 971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/AcPP9fCvdjztmho8.txt | High | Score 58/100 | First seen |
| Domain | osc-cdn.com | High | Score 58/100 | First seen |
| SHA256 | e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb | High | Score 58/100 | First seen |
| SHA256 | 133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098 | High | Score 58/100 | First seen |
| SHA256 | 7fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e32 | High | Score 58/100 | First seen |
| SHA256 | 9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3 | High | Score 58/100 | First seen |
| SHA256 | e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530 | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/byrdvvZEZZlk | High | Score 58/100 | First seen |
| SHA256 | 077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1 | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/KOOOT4a76st012bx.txt | High | Score 58/100 | First seen |
| URL | https://my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.wsf | High | Score 58/100 | First seen |
| URL | https://my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.hta | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/MKJacn3hFt3Y | High | Score 58/100 | First seen |
| SHA256 | 40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d | High | Score 86/100 | First seen |
| SHA256 | a0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221 | High | Score 58/100 | First seen |
| URL | https://my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.wsf | High | Score 58/100 | First seen |
| URL | https://my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.wsf | High | Score 58/100 | First seen |
| SHA256 | ae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585e | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/0u25lAqY58or53ra.js | High | Score 58/100 | First seen |
| SHA256 | ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800 | High | Score 86/100 | First seen |
| URL | https://my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.wsf | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/vD68BdmB2ky28gcc.js | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/BKvYRxPiGpbM | High | Score 58/100 | First seen |
| URL | https://my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.hta | High | Score 58/100 | First seen |
| Domain | r2.dev | Low | Score 31/100 | First seen |
| URL | https://my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.wsf | High | Score 58/100 | First seen |
| SHA256 | 2f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05 | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/ThyI9pwewrh_a1pr.txt | High | Score 58/100 | First seen |
| URL | https://my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.wsf | High | Score 58/100 | First seen |
| SHA256 | 170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a464 | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3WxnOsState.dat.pgy | High | Score 58/100 | First seen |
| SHA256 | e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34 | High | Score 58/100 | First seen |
| IP | 103.27.110.220 | High | Score 58/100 | First seen |
| SHA256 | 0b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc739 | High | Score 58/100 | First seen |
| SHA256 | b75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6 | High | Score 58/100 | First seen |
| SHA256 | 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff | High | Score 86/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/s0p18dgHR4PZ | High | Score 58/100 | First seen |
| SHA256 | 75c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513c | High | Score 58/100 | First seen |
| SHA256 | fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1 | High | Score 58/100 | First seen |
| SHA256 | f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8 | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6Zslc.dll.pzs | High | Score 58/100 | First seen |
| URL | https://my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.hta | High | Score 58/100 | First seen |
| SHA256 | 47f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2 | High | Score 58/100 | First seen |
| URL | https://my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.hta | High | Score 58/100 | First seen |
| SHA256 | 747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d533 | High | Score 58/100 | First seen |
| SHA256 | 9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f | High | Score 58/100 | First seen |
| SHA256 | 7969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b838 | High | Score 58/100 | First seen |
| SHA256 | bd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4 | High | Score 58/100 | First seen |
| SHA256 | d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a | High | Score 58/100 | First seen |
| SHA256 | 3a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02a | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/7ChyKauxbnuftp68.js | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/gpv0IRMtvto6e8t2.txt | High | Score 58/100 | First seen |
| SHA256 | 5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb | High | Score 58/100 | First seen |
| URL | https://my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.hta | High | Score 58/100 | First seen |
| SHA256 | 23d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3ac | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5SVIdjpRQjkZ | High | Score 58/100 | First seen |
| SHA256 | b8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655 | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/wyLwwCu43j1wf2pg.js | High | Score 58/100 | First seen |
| URL | http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/q9LgxIaU1CJK | High | Score 58/100 | First seen |
| SHA256 | 6a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56 | High | Score 58/100 | First seen |
| SHA256 | cd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7 | High | Score 58/100 | First seen |
| SHA256 | aea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90 | High | Score 58/100 | First seen |
| URL | https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgGatherOsState.exe.lzj | High | Score 58/100 | First seen |
| URL | https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/Ub4RJzNIrfleri8t.txt | High | Score 58/100 | First seen |
| URL | https://www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…