cyber.hendryadrian.com
Security News · therecord.media

Reports Link China-Backed Groups to Phishing Campaigns and Antino Backdoor Attacks in Asia

· Original article ↗

Summary

Proofpoint and Cisco Talos reported China-linked campaigns using AI-policy phishing lures to steal credentials and the Antino backdoor to target government organizations across Asia for intelligence gathering.

Key points

  • Proofpoint described phishing emails impersonating economists and a former U.S. official to target AI experts at universities, think tanks, and law firms.
  • Fake AI policy initiatives and a Senate report on AI export controls were used to build rapport with targets.
  • Follow-up links led to OneDrive credential-phishing pages designed to steal victims’ login information.
  • Cisco Talos reported Antino backdoor activity targeting government organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria.
  • Talos identified 16 organizations affected or targeted and about 350 compromised endpoints across eight countries between September 2025 and July 2026.
  • Antino enabled reconnaissance, file transfers, and persistent access; researchers said the campaign sought intelligence.

Article Details

Event Type
Phishing and backdoor campaigns attributed by researchers to Chinese state-backed hacking groups.
Impact
The campaigns sought to steal credentials and maintain access for reconnaissance and intelligence gathering. Cisco Talos reported about 350 compromised endpoints across eight countries and identified 16 organizations as affected or targeted.

MITRE ATT&CK

T1566.002 · Spearphishing LinkThe campaigns used phishing emails containing malicious links to target victims.

People

Heidi Crebo-RedikerProofpoint reported that phishing emails impersonated her after initially impersonating Lynne Edwards Parker.Lynne Edwards ParkerProofpoint reported that phishing emails impersonated her to target AI experts.

Malware

AntinoCisco Talos and Proofpoint linked the activity to the Antino backdoor and multiple campaigns aimed at intelligence gathering and access persistence.

Countries

Cambodiaby Chinese state-backed groups to target government organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria.IndiaAntino backdoor used in Taiwan, India, PhilippinesJapanIt typically registered domains impersonating legitimate organizations like The Heritage Foundation, the Japan-Taiwan Exchange Association and the office of Japan’s Defense Minister.Myanmarto target government organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria.Pakistanstate-backed groups to target government organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria.PhilippinesAntino backdoor used in Taiwan, India, PhilippinesSyriagovernment organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria.TaiwanIt typically registered domains impersonating legitimate organizations like The Heritage Foundation, the Japan-Taiwan Exchange Association and the office of Japan’s Defense Minister.Thailandgroups to target government organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria.

Industries

Artificial intelligenceChinese government-backed hacking groups allegedly targeted artificial intelligence companies and several Asian governments in recent campaigns, according to two new reports this week.Defenseand Japanese think tanks, defense contractors and universities.GovernmentChinese government-backed hacking groups allegedly targeted AI experts, think tanks, universities, and government organizations across Asia through phishing lures and credential theft.Think tanksChinese government-backed hacking groups allegedly targeted AI experts, think tanks, universities, and government organizations across Asia through phishing lures and credential theft.

Related Articles