Cisco Talos published its findings on a cluster it tracks as UAT-11587, which it says targeted government and policy organisations across Asia, including in Taiwan, India, the Philippines and Cambodia, to deliver a backdoor it calls Antino.

Talos wrote "China-nexus". It did not write "China". The cluster carries a tracking number, not a name, which is how Talos signals that it has seen the activity and has not yet matched it to a known group.

The Record's headline on the same research reads "Chinese Hackers Hit AI Firms And Asian Governments". Attribution tightened between the Talos blog and the headline.

The victim list is the part with evidence behind it. Four named countries, one backdoor, government and policy organisations alike. Policy bodies hold drafts, negotiating positions and contact lists, which is what a backdoor on a quiet network is for.

The Record paired this report with a second one, covering a phishing campaign that impersonated Western experts. The excerpt I have does not say whether the two share infrastructure, and I will not suggest they do.

My read is that "China-nexus" is the accurate phrase and the one readers will drop first. (A tracking number is the only part of this story nobody has yet rounded up.)

Antino is a named backdoor. Check endpoint and mail logs for anything touching Asian government counterparties, because the cluster's own victim list says that is where it has been working.