Fortinet exposes the PapRAT malware campaign. See how the BITTER PapRAT malware uses three infection chains and Rust to spy on South Asian targets.
Related Posts:
Apple Mercenary Spyware Threat Prompts Global Alerts
Hugging Face Malware Campaign Infects AI GPU Servers
PSK Agent RAT Hits Magento Stores Through StyleSmuggler Exploitation
The post BITTER PapRAT Malware Targets South Asian Organizations appeared first on Daily CyberSecurity.
The VULONE Team reveals that the Kimsuky Operation GitPower campaign remains live on GitHub, with Operation GitPower repos staging AnyDesk malware.
Related Posts:
Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks
Binance Hack Report Details Fake Job Interview, AI Tool Abuse and EIP-7702 Wallet Drain
Kaspersky Uncovers CyberStrikeAI Framework Attacks on Schools
The post Kimsuky Operation GitPower Staging Infrastructure Stays Live on GitHub appeared first on Daily Cyb
Cisco Talos details UAT-11587, a China-linked group using the Antino backdoor and Microsoft 365 as cover to spy on Asian governments.
Cisco Talos has been tracking a cluster of espionage activity since September 2025 that it calls UAT-11587, and by July 2026 the group had hit at least 16 government and policy organizations across eight Asian countries. The toolset includes a previously undocumented backdoor Talos named Antino, and the thing that makes it worth paying attention to isn’t how i
Cisco Talos details UAT-11587, a China-linked group using the Antino backdoor and Microsoft 365 as cover to spy on Asian governments.
Cisco Talos has been tracking a cluster of espionage activity since September 2025 that it calls UAT-11587, and by July 2026 the group had hit at least 16 government and policy organizations across eight Asian countries. The toolset includes a previously undocumented backdoor Talos named Antino, and the thing that makes it worth paying attention to isn’t how it gets in. It’s where it hides once it’s there.
Antino is written in Rust and works on both 32-bit and 64-bit versions of Windows. It supports the usual backdoor features, including shell and PowerShell access, file transfers, in-memory shellcode execution and persistence.
“Antino is a Rust-compiled Windows backdoor that supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading and persistence. Its native command-and-control channel operates exclusively through Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive.” reads the report published by Talos.
None of these features are particularly new. What makes Antino different is how it communicates: instead of using its own command-and-control server, it uses Microsoft Graph to read commands from an Outlook mailbox and send stolen files to OneDrive. This allows its traffic to blend in with normal Microsoft 365 activity.
The attack starts in a more traditional way, with a convincing phishing email. UAT-11587 created highly targeted documents that suggest the attackers had researched their victims, including a fake workshop document about Taiwan’s information warfare and a document that closely copied a real Taiwan Ministry of Finance ruling about tax treatment for legislators.
“The document exactly reproduces a public Taiwan Ministry of Finance ruling to make the decoy appear credible.” conctinues the report. “Its subject strongly suggests that it was prepared for members of Taiwan’s public sector.”
In another case, the attackers reused a real Associated Press story about alleged Russian offers to the US over Venezuela. Matching malware samples appeared on VirusTotal two days after the original article was published.
The delivery trick is a simple but effective email spoofing technique that takes advantage of a gap many people overlook. The attackers sent the email through a legitimate provider, using one domain as the technical sender, while the visible From address showed the organization they were impersonating. SPF passed because the real sending domain was authorized, but DMARC detected the mismatch and failed. That still wasn’t enough to block the message. The impersonated domain had a DMARC policy set to monitoring rather than rejection, so the failed email still reached the inbox.
The Gmail trick is even more interesting. The attackers recreated Gmail’s normal attachment preview card almost pixel by pixel using images embedded in the email’s HTML. They then made the fake preview a link to a page controlled by the attackers. Open the email in Gmail and it looks just like the real thing because Gmail simply renders the HTML it receives. There is no exploit here. It’s just a very convincing copy of something users already trust.
From that click, a five-stage chain kicks in, leaning on legitimate-looking HTA files, Windows Script Host, and a scripted .NET deserialization trick that abuses a known gadget chain to load malicious code inside a trusted process. The final stage sideloads Antino through a signed Microsoft diagnostic binary, meaning the thing dropping the backdoor onto disk is a tool Windows itself trusts by default. Cloudflare Pages, R2, and Amazon CloudFront carried almost every stage of this, which kept the traffic blending into ordinary HTTPS the whole way through.
Once Antino is running, it checks its Outlook mailbox for new commands every ten seconds. The commands and results are sent as structured JSON hidden inside specially formatted email subjects.
“The Antino backdoor receives commands through email messages. The implant actively pulls commands from the threat actor’s Outlook mailbox folder every 10 seconds. The protocol uses two message types: command emails contain tasking from the controller, while response emails contain the implant’s results.” states Talos. “Command messages are identified by the subject prefix command_req_[session_id] and responses by command_res_[session_id], as indicated in the HTTP GET request sent by Antino: “
A separate system is used to upload stolen files to one OneDrive folder and download attacker tools from another. Even the naming makes the attacker’s perspective clear: “uploads” are files sent to the victim, while “downloads” are files pulled back from the victim.
The attribution case leans on accumulated small details rather than any single smoking gun, which is honestly how these assessments should work. Decoy document metadata carries Simplified Chinese language tags and a UTC+8 timestamp, a combination more consistent with mainland China than Taiwan or Hong Kong, where Traditional Chinese dominates. Separately, ten different Antino builds reference a Rust package mirror built specifically to speed up dependency downloads inside mainland China, the kind of tooling choice a developer picks for convenience, not for disguise.
The victim list reads like a checklist of what an intelligence service would actually want: defense ministries, legislatures, foreign affairs offices, border and interior security agencies, plus the think tanks and civil society groups that tend to know things governments care about early. Around 350 compromised endpoints turned up across eight countries, with the largest single wave, roughly 57 new endpoints, hitting India over two days in June. That’s not noise. That’s a deliberate and sustained collection effort.
“Based on the development, preparation-environment, and targeting indicators detailed in this report, Talos assesses with high confidence that UAT-11587 is China-nexus.” the report concludes.
UAT-11587 Antino backdoor attacks hit Asian targets. Cisco Talos reveals how the Antino backdoor abuses Microsoft 365 for cyberespionage.
Related Posts:
PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot
Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions
New MacSync macOS Infostealer Targets Crypto Wallets
The post UAT-11587 Targets Asian Governments With Antino Backdoor appeared first on Daily CyberSecurity.
Proofpoint exposed China-aligned TA419 credential phishing targeting AI experts. This TA419 credential phishing campaign uses AitM lures to steal logins.
Related Posts:
Phishing Abuses RMM Tools for Persistent Network Access
Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells
Russia's Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor
The post China-Aligned TA419 Credential Phishing Hits AI Experts appeared first on Daily CyberSecu
SOCRadar uncovered the Konni Operation Conflict Compass campaign targeting Ukraine. Learn how Operation Conflict Compass uses fake PDFs and VelvetCake.
Related Posts:
Kiteworks Mandates Global Precautionary Server Shutdown
TraderTraitor macOS Backdoors Target IT Service Firms
TeamFiltration Password Spray Campaign Hits Chile
The post Konni Launches Operation Conflict Compass Against Ukraine appeared first on Daily CyberSecurity.
Group-IB uncovered Iranian HEAVYGRAM malware campaigns. The HEAVYGRAM malware abuses Telegram channels for command execution and data theft.
Related Posts:
MovieReaper Malware Spreads via Compromised Torrents
LLM-Generated PhantomRaven Information Stealer Discovered
KREMLIN Banking Malware Targets Brazilian Banks
The post HEAVYGRAM Malware Abuses Telegram for Cyberespionage appeared first on Daily CyberSecurity.
Learn how the NightEagle APT GhostContainer attacks exploit Exchange servers in Russia. Protect your network from the NightEagle APT.
Related Posts:
Google Undercover Analyst Infiltrates Hacking Gang
PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures
Tajin Group Phishing Network Linked to Guarantee Marketplaces
The post NightEagle APT GhostContainer Attacks Target Russia appeared first on Daily CyberSecurity.
Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia.
Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT command‑and‑control servers that predate and extend Bitdefender’s August 2026 SilkParasite report. The work doesn’t dissect malware samples; it maps the network side of the operation with enough precision to tie three of SilkParasite’s seven RAT families (SpiceRAT, NodeEdgeRAT
Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia.
Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT command‑and‑control servers that predate and extend Bitdefender’s August 2026 SilkParasite report. The work doesn’t dissect malware samples; it maps the network side of the operation with enough precision to tie three of SilkParasite’s seven RAT families (SpiceRAT, NodeEdgeRAT, and NomadRAT) through shared certificates, domains, and hosting patterns.
“Shared parent domains and an identical TLS certificate connect this infrastructure to hosts Bitdefender attributed to SpiceRAT, NodeEdgeRAT, and NomadRAT, three of the seven malware families documented in the SilkParasite report.” reads the report published by Hunt.io.
“The certificate imitating the Uzbekistan railway entity was issued by TLC, a certificate authority wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology.”
In March 2026, Hunt.io identified five SpiceRAT command-and-control servers hosted by different providers and in different countries. Researchers linked them through several common elements, including the same hostnames, TLS certificates, and a cloned webpage used as the default page.
Instead of focusing only on the malware itself, this approach looks at the infrastructure behind it. Shared certificates or identical webpage hashes can provide strong and practical indicators that defenders can use to identify other servers linked to the campaign.
One certificate in particular stands out. It impersonates Uzbekistan’s state railway authority (azure.uzrailwaystax[.]com) and was issued by TLC DV TLS CA, a CA wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology. The issuer alone isn’t an indicator—nearly 3,000 servers host TLC certificates—but a domain‑validated cert spoofing a Central Asian state entity from a China‑based CA does suggest a deliberate procurement channel.
Requests to ns2.asiainfo.it[.]com on 188.190.29[.]126 returned a full copy of RTX Corporation’s homepage, complete with navigation, subsidiary links, and a stock ticker. The page contained no malicious code and wasn’t unique to that server, but its reuse across the cluster made it a powerful fingerprint.
“Hunt.io’s C2 Infrastructure module tracks servers matching detection signatures for known malware families, including SpiceRAT. In mid-March 2026, we observed a cluster of five active SpiceRAT servers: 46.30.191[.]230, 188.190.29[.]126, 193.29.59[.]159, 31.58.220[.]250, and 171.22.16[.]187. The five were active together in mid-March 2026, across multiple hosting providers and countries.” continues the report.
A HuntSQL query on the page’s SHA‑256 hash returned exactly 13 hosts; three were already in Bitdefender’s SpiceRAT list, two more matched Hunt.io’s SpiceRAT signature, and the remaining eight extended the footprint through shared nginx versions and the same static page.
Why RTX? The report offers two plausible explanations: the page rendered cleanly and was grabbed as a convenient template, or it reflects shared tooling where the clone functions as a default deployment asset. Either way, for defenders it’s a low‑noise, high‑precision signature: byte‑for‑byte identical wherever it lands.
Bitdefender’s SilkParasitereport treated several RAT families as distinct, but Hunt.io’s network view shows they share parent domains and certificates. For example, help.hoster‑kg[.]com (on 193.29.58[.]192) presented the same railway‑spoofing certificate, while Bitdefender attributed evo.hoster‑kg[.]com to NodeEdgeRAT; the two are linked through shared registration of hoster‑kg[.]com, not a shared server. Similarly, kg.tdtu[.]org shares a parent domain with mineconom.tdtu[.]org, a NomadRAT C2 indicator in the SilkParasite report.
This doesn’t prove a single operator, but it does show a support function or toolset shared across the campaign. From a detection standpoint, it means pivoting on domains, certificates, and hosting profiles can surface nodes that sample‑based analysis would miss.
The cluster’s domains don’t just look governmental; they spoof specific ministries and state enterprises. Examples include help.galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz‑server[.]com (Türkmengaz), tm‑mfa[.]com (Turkmenistan’s Ministry of Foreign Affairs), and tojiktelecomtj[.]com (Tojiktelecom, Tajikistan). Additional domains impersonate Turkmen energy (sanly.oilgas‑tm[.]com), Uzbek administration (azure.adm‑devon[.]com), and even the Kyrgyz president’s residence (data.yntymak‑ordo[.]com).
Bitdefender’s targeting came from lures and infection telemetry; Hunt.io’s infrastructure analysis names the same sectors with concrete entities. Passive DNS and subdomain enumeration push the timeline back to mid‑2022, suggesting this isn’t a new campaign with a fresh brand—it’s a longer‑running operation now labeled SilkParasite.
SilkParasite overlaps with FamousSparrow, a suspected China‑nexus actor previously seen targeting hotels, governments, and international organizations. The infrastructure also mirrors IndigoZebra (Speccom), documented by Check Point in 2021 as targeting Central Asian ministries with similar domain patterns (mail, service, help) and overlapping naming conventions. These parallels don’t settle attribution, but they do reinforce a consistent operational style across China‑nexus activity in Central Asia.
If you’re responsible for OT/ICS, telecom, or government networks in the region, start by checking your edge and DMZ for the indicators below, especially the RTX page hash and the railway‑spoofing certificate. Monitor for high‑numbered RDP‑over‑TLS ports (64350, 64330, 65535, 65111) on the ASNs most prevalent in the cluster, and watch for domains impersonating local hosting providers or state entities. The original Hunt.io post includes the full IoC tables and HuntSQL queries; linking to it is essential for precise awareness and for teams that want to reproduce the pivots.
“The targeting picture that emerges from this infrastructure, named ministries and state enterprises across five Central Asian countries dating back to at least mid-2022 suggests SilkParasite is a more recent label for an operation with much longer and wider footprint.” concludes the report. “Organizations in the affected sectors and regions can make use of the above indicators and observations to assess their own exposure.”
Entrar
