THREATNOIR
Subscribe
Back to advisories

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

China-nexus group UAT-11587 is deploying Antino, a Rust-compiled backdoor that abuses Outlook and OneDrive for C2 communications. Government and policy organizations across eight Asian countries are being targeted in an active espionage campaign since September 2025. The use of legitimate Microsoft 365 services for command and control will evade standard network detection.

HIGHAdvisoryOct 04, 2026
Action required
Hunt for Outlook and OneDrive API calls with suspicious patterns: unusual attachment exfiltration, calendar/contact access for data staging, and OneDrive sync to external accounts. Cross-reference with endpoint telemetry for Rust-based process execution and suspicious Microsoft Graph API tokens.
Linked articles
Source links