Antino Backdoor Uses Outlook and One Drive for C2 in China-Nexus Espionage Campaign
Summary: Cisco Talos is tracking a China-nexus cluster it calls UAT-11587, which has deployed a previously undocumented Rust-compiled Windows backdoor named Antino against 16 entities across eight Asian countries, including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. Antino runs its command-and-control exclusively through Microsoft 365, fetching commands from an Outlook mailbox folder every 10 seconds by looking for messages with the subject prefix "command_req_[session_id]" and using OneDrive for heartbeat and file transfer.
Bottom line: The implant's traffic rides inside Microsoft 365 rather than a dedicated C2 server, so the Outlook and OneDrive sessions your organization already trusts are the channel - and the actor spoofed trusted senders to bypass SPF and DMARC and rebuilt Gmail's attachment preview in HTML to make the lure indistinguishable from a real one.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026