Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

1. Executive summary

A China-nexus intrusion set tracked by Cisco Talos as UAT-11587 has deployed a previously undocumented Rust-compiled Windows backdoor, Antino, against government and policy organisations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand and Myanmar, with additional targeting of organisations in Syria around May 2026. Antino's native command-and-control runs exclusively over Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive, which means C2 traffic blends into legitimate tenant activity rather than reaching an external endpoint. Initial access is by spear-phishing with spoofed sender identities crafted to pass SPF and DMARC. No CVE is referenced in this item and the verified reference data records no CVSS score, severity or CISA KEV entry, so this advisory carries no vulnerability-patch action; the exposure is to identity, mail and file-storage abuse inside a tenant the target already trusts. The attribution to a China-nexus actor is assessed with high confidence by Talos but rests on a single vendor report, and no MITRE ATT&CK profile exists for this cluster in the verified reference data, so the attribution is unconfirmed for our purposes.

2. Regulatory framing

No DORA Art. 18, 19, 24, 29 or 30 trigger and no NIS2 Art. 23 or UK NIS 2018 trigger is established by the facts in this item; those articles turn on facts (incident classification, reporting thresholds, concentration assessment, contractual provisions, UK OES/RDSP status) that the source does not supply.

3. Technical analysis & attack chain

Confirmed steps, as reported by Cisco Talos via The Hacker News:

1. The actor sends spear-phishing email to government and policy organisation staff. Sender identities trusted by the recipients are spoofed so the messages pass SPF and DMARC checks and reach the inbox.
2. Lure content is tailored to the target: Taiwanese political, legislative, civil defence and policy research subjects, plus regional government, maritime, diplomatic and security themes. Talos states the tailoring indicates prior reconnaissance of the target organisations.
3. A JavaScript downloader associated with UAT-11587 retrieves the next stage. The downloader references the CloudFront domain d32tpl7xt7175h.cloudfront[.]net.
4. Antino, a Rust-compiled Windows backdoor, is deployed on the host.
5. Antino performs host reconnaissance, executes shell and PowerShell commands, transfers files, loads shellcode in memory, and establishes persistence.
6. Command-and-control runs exclusively through Microsoft 365. Antino uses Microsoft Graph to interact with Outlook and OneDrive, so tasking and exfiltration ride on the tenant's own mail and file-storage services.

Antino capabilities, per Talos: host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. The source does not name the persistence mechanism, the specific Graph API calls, the mailbox or OneDrive objects used for tasking, or the exfiltration format. Those gaps matter for detection and are not filled here.

Targeting and timing. The actor was first detected in September 2025 in a spear-phishing campaign against Taiwan's academic, think tank and civil society policy community. Activity has since expanded to 16 entities across eight Asian countries. Attacks spiked between March and early June 2026, with a concentrated wave on 8 and 9 June 2026 against dozens of systems in government IT infrastructure. Organisations in Syria were targeted around May 2026.

Attribution and confidence caveats. Talos assesses UAT-11587 as China-nexus with high confidence, citing zh-CN language and Simplified Chinese metadata in lure documents, a UTC+08:00 time zone in the spear-phishing message header, and the collection focus of the lures and targets. Two further indicators are given: nearly a dozen distinct Antino build outputs carry Cargo registry paths referencing rsproxy[.]cn, a mainland China mirror and proxy for crates.io, and the JavaScript downloader references d32tpl7xt7175h.cloudfront[.]net, a CloudFront domain Arctic Wolf previously flagged in a campaign by a China-affiliated actor tracked as UNC6384 against European diplomatic and government entities using an unpatched Windows shortcut vulnerability. The link between UAT-11587 and Jewelbug is contested: Symantec and Carbon Black characterised Jewelbug in August 2026 as a China-based hackers-for-hire group running both espionage and a for-profit cryptocurrency fraud business, and Talos reports overlap between UAT-11587 and Jewelbug, but Talos also states its own investigation found no connection between this espionage campaign and Jewelbug's financially motivated activity, and designated UAT-11587 a separate activity set. This entire section rests on a single vendor report (Cisco Talos, relayed by The Hacker News); the attribution, the build-path indicator and the CloudFront overlap are single-sourced and should be treated as unconfirmed until corroborated. The verified reference data holds no MITRE ATT&CK profile for this cluster, so no technique mapping is asserted.

4. Mitigation & containment

P1 (within 24 hours)

• Hunt Microsoft 365 audit and Graph activity for anomalous Outlook and OneDrive access from non-browser, non-standard clients. Antino's C2 is Graph-based, so the pivot is application and user-agent telemetry in the tenant, not an external IP blocklist.
• Review sign-in and audit logs for the concentrated window of 8 and 9 June 2026 and for the March to early June 2026 spike, focusing on government IT infrastructure accounts.
• Enforce DMARC at p=reject on all owned domains and confirm SPF and DKIM alignment. The actor spoofed trusted sender identities specifically to pass SPF and DMARC, so alignment failures on inbound mail from trusted partners are the signal to alert on.
• Block or alert on the CloudFront domain d32tpl7xt7175h.cloudfront[.]net at the web proxy and DNS layer. Treat this as a single-sourced indicator; verify against your own telemetry before hard enforcement.

P2 (within 72 hours)

• Restrict Microsoft Graph application permissions to the minimum required and review all existing app registrations and consented permissions for mail and file access. Antino's channel depends on Graph access to Outlook and OneDrive; over-permissioned apps widen it.
• Enable and centralise Microsoft 365 unified audit logging if not already on, and forward it to the SIEM. Without it, Graph-based C2 is effectively invisible.
• Hunt for Rust-compiled binaries and for Cargo build artefacts on endpoints and build hosts. The rsproxy[.]cn Cargo registry path in Antino build outputs is a development-environment indicator worth sweeping for.
• Apply conditional access requiring compliant, managed devices for mail and file access, which raises the cost of a Graph-based implant operating from an unmanaged host.

P3 (within 7 days)

• Run a targeted phishing simulation and briefing for staff in policy, government liaison and diplomatic functions, using the lure themes named in this item (political, legislative, civil defence, maritime, diplomatic, security) so the training matches the actual targeting.
• Review third-party and cloud service contracts against DORA Art. 28 expectations for monitoring and incident cooperation on the Microsoft 365 dependency.
• Tabletop the incident management process against a scenario where the compromise presents as ordinary mailbox and file activity, per DORA Art. 17.

No vendor fix or patch is named in this item because no CVE is referenced. There is nothing to version-pin or patch here; the remediation is identity, mail authentication and Graph permission hygiene.

5. Indicators of compromise

domain  d32tpl7xt7175h.cloudfront[.]net
domain  rsproxy[.]cn

Note on rsproxy[.]cn: this is a legitimate public crates.io mirror. Its presence in Antino build metadata is an actor-environment artefact, not a malicious service. Do not block it wholesale without confirming it is not in legitimate developer use in your estate.

No file hashes, IP addresses, mailbox identifiers or file paths are present in the source material. The source describes observable behaviours but no atomic host indicators beyond the two domains above.

Behavioural indicators

6. Detection

The source gives distinctive artefacts: the CloudFront domain, the Cargo registry path, and the Antino capability set. The YARA rule below keys on the two named domains and the Cargo registry string, which are genuine artefacts of the delivery and build stages. It does not key on the actor or malware name, which would only detect reporting about the threat.

rule UAT11587_Antino_Delivery_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-02"
        reference = "https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html"
        description = "Detects strings associated with UAT-11587 Antino delivery and build artefacts: CloudFront downloader domain and rsproxy Cargo registry path"
    strings:
        $cf = "d32tpl7xt7175h.cloudfront.net" ascii wide
        $cargo = "rsproxy.cn" ascii wide
        $graph = "graph.microsoft.com" ascii wide
    condition:
        uint16(0) == 0x5A4D and ($cf or $cargo)
}

The Sigma rule below targets the behavioural signal that matters most for this campaign: Graph-based access to mail and file storage from a client that is not a browser or the standard Outlook client, which is how Antino's C2 presents.

title: Microsoft Graph Mail and File Access from Non-Standard Client
id: 8f3c1a72-4b6e-4d21-9c88-2a7e5f0d1b34
status: experimental
description: Detects Microsoft Graph access to Outlook and OneDrive from a user agent that is not a browser or the standard Outlook client, consistent with the Antino backdoor C2 channel described by Cisco Talos
author: Adverse Trace
date: 2026/10/02
references:

    - https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html
logsource:
    product: m365
    service: audit
detection:
    selection_operation:
        Operation:

            - 'MailItemsAccessed'
            - 'FileAccessed'
            - 'FileDownloaded'
    filter_browser:
        UserAgent|contains:

            - 'Mozilla'
            - 'Outlook'
            - 'Microsoft Office'
    condition: selection_operation and not filter_browser
falsepositives:

    - Legitimate third-party mail or backup integrations using Graph
    - Custom internal applications with consented Graph permissions
level: medium

Tune the false-positive filter against your own app registration inventory before enabling at high severity.

7. Sources

• The Hacker News, "Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign", https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html, 2026-10-02. Reporting Cisco Talos research by Ashley Shen; the sole source for all technical detail in this advisory.

8. Adverse Trace position

Adverse Trace assesses this as a targeted espionage campaign with no vulnerability component: there is no CVE, no CVSS score and no CISA KEV entry in the verified reference data, so the risk is not patchable and does not fit a vulnerability-management response. The exposure for EMEA financial services clients is indirect but real: the C2 channel is Microsoft 365 Graph access to Outlook and OneDrive, a service nearly every client runs, and the delivery technique spoofs trusted senders to pass SPF and DMARC, so the intrusion presents as ordinary tenant activity. The attribution to a China-nexus actor is assessed high confidence by Talos but is single-sourced and has no MITRE ATT&CK profile in our reference data, so we treat it as unconfirmed and will not map techniques to it. We will monitor for corroborating vendor reporting on UAT-11587 and Antino, and we will update this advisory if a second source confirms the build-path or CloudFront indicators or names the persistence mechanism, which the current source does not. Clients who want to act now should prioritise the P1 Graph and DMARC hunts over any patch activity, because there is nothing here to patch.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.