Threat Intel·Chinese Cyber Threat Intelligence·Oct 2, 2026·ByBulwark Bastion

Antino Backdoor Shows Why Microsoft 365 C2 Needs Cloud-Aware Detection

Cisco Talos reports China-nexus UAT-11587 used the Antino backdoor with Outlook and OneDrive as command-and-control channels. Here is what SMB and government-contractor defenders should monitor.

Cisco Talos published research on UAT-11587, a China-nexus espionage cluster using a previously undocumented Rust-based Windows backdoor called Antino. The campaign matters because the final-stage malware does not rely on a classic suspicious command-and-control server. Talos says Antino uses Microsoft Graph to interact with Outlook and OneDrive, turning trusted Microsoft 365 services into the command, heartbeat, and file-transfer layer.

For defenders, this is the uncomfortable part: blocking bad domains is not enough when the post-compromise channel blends into normal SaaS traffic. SMBs and government contractors increasingly run their identity, email, storage, collaboration, and endpoint telemetry through cloud platforms. If attackers can hide tasking inside those same platforms, security teams need detection that understands identity behavior, application consent, process lineage, and cloud audit logs together.

What Cisco Talos reported

Talos tracks the activity as UAT-11587 and assesses with high confidence that it is China-nexus. The campaign targeted government, policy, academic, civil society, and national-security-adjacent organizations across Asia, including activity affecting or targeting environments in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria.

The delivery chain begins with tailored spear-phishing. Talos described lures that cloned Gmail attachment widgets, used policy and regional-security themes, and exploited sender-domain alignment gaps where SPF could pass for the envelope sender while the visible From domain failed DMARC but was still delivered under a non-enforcing policy.

From there, the infection chain uses cloud-hosted HTA and WSF stagers, JavaScript downloaders, encrypted resources, .NET BinaryFormatter deserialization, DLL sideloading through a legitimate Microsoft-signed binary, and finally Antino. Talos says the actor relied heavily on Cloudflare Pages, Cloudflare R2, and Amazon CloudFront for delivery, staging, tracking, and decoy content.

Why Antino stands out

Antino is not just another commodity backdoor. Talos describes it as a Rust-compiled Windows implant with support for host reconnaissance, command execution, PowerShell execution, file listing, file upload and download, in-memory shellcode loading, and persistence through a Registry Run value.

The more important design choice is the C2 model. Antino receives commands through Outlook messages and uses OneDrive for heartbeat and file transfer. The implant polls the operator’s mailbox for command messages, executes tasks on the endpoint, and returns results through the same Microsoft 365-backed workflow.

That architecture creates a detection problem. A firewall may only see encrypted traffic to Microsoft services. A proxy may treat the destination as business-normal. An endpoint alert may show mshta.exe, Windows Script Host, or a signed Microsoft binary in the chain, but without cloud context the full intrusion can look fragmented.

Why this matters for SMBs and government contractors

Government contractors and small public-sector-adjacent organizations are often attractive because they sit near policy, defense, supply-chain, or grant-funded work but do not always have mature cloud detection. They may have Microsoft 365, MFA, EDR, and email security, but still lack the cross-layer visibility needed to connect suspicious endpoint behavior with unusual Graph, Outlook, or OneDrive activity.

This campaign is also a reminder that phishing defense cannot stop at user training. UAT-11587 used tailored content, official-looking documents, current geopolitical themes, cloud-hosted payloads, and sender-spoofing details that can defeat casual inspection. The defensive answer has to include technical controls around script execution, attachment handling, cloud application activity, and identity logging.

Defensive takeaways

Correlate endpoint and cloud telemetry. Treat Microsoft 365 audit logs, Entra ID sign-in logs, Graph API activity, Defender telemetry, and EDR process trees as one investigation surface.
Watch script-host process chains. Alert on mshta.exe, wscript.exe, cscript.exe, rundll32.exe, and signed binaries launching from unusual user-writable paths, especially after email or browser activity.
Hunt for cloud-backed dead drops. Baseline normal Outlook and OneDrive usage. Investigate automated polling, unusual message subjects, repetitive Graph calls, unexpected file movement, and service activity from endpoints that do not normally automate Microsoft 365.
Do not rely only on domain reputation. Cloudflare, CloudFront, Outlook, and OneDrive are legitimate services. Controls need to evaluate behavior, file type, process parentage, and tenant-level audit context.
Harden email authentication enforcement. DMARC monitoring mode is useful during rollout, but high-risk domains should move toward quarantine or reject once aligned mail flows are understood.
Restrict legacy script execution where possible. Reduce exposure to HTA, WSF, and other legacy Windows script paths with attack surface reduction rules, application control, and user-role-based restrictions.
Review Microsoft Graph permissions and app consent. Investigate unusual delegated or application permissions that could support mailbox, OneDrive, or file access abuse.
Use the published detections and IOCs as a starting point. Talos published Snort and ClamAV coverage plus indicators. Load them where applicable, but build behavior-based hunts as well.

Bulwark Black assessment

Antino is a good example of where intrusion tradecraft is heading: less obvious infrastructure, more abuse of trusted SaaS workflows, and more pressure on defenders to understand what “normal” looks like inside cloud applications. For smaller teams, the win is not to build a perfect nation-state detection stack overnight. The win is to close the biggest gaps first.

Start with visibility. Make sure Microsoft 365 audit logging is enabled, Entra ID logs are retained, endpoint telemetry captures script-host execution, and alerts can be investigated across identity, email, endpoint, and cloud storage. Then reduce easy execution paths: block unnecessary HTA/WSF usage, control unsigned scripts, monitor DLL sideloading patterns, and require stronger mail authentication handling for domains that represent executives, partners, or government stakeholders.

If your organization handles policy work, defense-adjacent projects, CUI, international programs, or government contracting data, this style of campaign should be treated as relevant even if the current victimology is Asia-focused. The technique is portable, the cloud services are common, and the defensive lesson applies broadly: trusted SaaS traffic still needs threat hunting.

Original source: Cisco Talos — China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor.

Extracted Observables

157 observables, auto-extracted and defanged.

Analysis artifacts

TXT CSV JSON YARA

Choose a file to view it here. Values are live, not defanged.

IPv4 (1)

103[.]27[.]110[.]220

Domains (23)

d2nq35tel3ucuo[.]cloudfront[.]netd32tpl7xt7175h[.]cloudfront[.]netlogin[.]microsoftonline[.]commicrosoft-flash[.]commy-3lyt6wcp[.]pages[.]devmy-662ylt3w[.]pages[.]devmy-6g16qsfe[.]pages[.]devmy-goq6xmbm[.]pages[.]devmy-h3qli6kq[.]pages[.]devmy-qc39r814[.]pages[.]devmy-sv7c1fzs[.]pages[.]devmy-u0up9qri[.]pages[.]devmy-vtsdod2n[.]pages[.]devmy-wgoxp32b[.]pages[.]devoisadjfoinsiduhfnoisdnfosdnoifnsoid[.]pages[.]devosc-cdn[.]compage[.]devpub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]devpub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]devr2[.]devrsproxy[.]cnwps-cn[.]comwww[.]wps-cn[.]com

URLs (68)

hxxp://d2nq35tel3ucuo[.]cloudfront[.]net/4oyE4n4ozLQ0[.]loghxxp://d2nq35tel3ucuo[.]cloudfront[.]net/LtVGUSsyUTDA[.]loghxxp://d2nq35tel3ucuo[.]cloudfront[.]net/TzzyYlYnJ40Z[.]loghxxp://d2nq35tel3ucuo[.]cloudfront[.]net/tdyvHHVcrci8[.]loghxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5SVIdjpRQjkZhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5TGrbjCCLa8Mhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5U7kzhvlYlVFhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/6HJV5qV5BTLshxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/BKvYRxPiGpbMhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/HenUWB51MwpGhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/MKJacn3hFt3Yhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/PbyfSk69AwVfhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/byrdvvZEZZlkhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/cX8MChhuVvzzhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/icWMOGLJcfQOhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/nswz3cb9lhuChxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/q9LgxIaU1CJKhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/qMD71Z95clTfhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/s0p18dgHR4PZhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/zlKDeyO3HuUShxxp://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/Qw7Womin4X6Nhxxp://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/kVFPxm1uAjOYhxxps://d2nq35tel3ucuo[.]cloudfront[.]net/9q9OlLKCm0an2ct1[.]jshxxps://d2nq35tel3ucuo[.]cloudfront[.]net/HsOw0YU9s11dxyr1[.]txthxxps://d2nq35tel3ucuo[.]cloudfront[.]net/LwqPW64Xl0ti3q7s[.]txthxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en[.]exehxxps://my-662ylt3w[.]pages[.]dev/Institutional_Disciplinary_Action_Report_May_2026[.]htahxxps://my-662ylt3w[.]pages[.]dev/Institutional_Disciplinary_Action_Report_May_2026[.]wsfhxxps://my-6g16qsfe[.]pages[.]dev/the%20May%2027%20inauguration%20of%20the%20TPiE[.]htahxxps://my-6g16qsfe[.]pages[.]dev/the%20May%2027%20inauguration%20of%20the%20TPiE[.]wsfhxxps://my-goq6xmbm[.]pages[.]dev/Tehran_Bilateral_Summit_Proceedings_May2026[.]htahxxps://my-goq6xmbm[.]pages[.]dev/Tehran_Bilateral_Summit_Proceedings_May2026[.]wsfhxxps://my-h3qli6kq[.]pages[.]dev/CrossBorder_Repression_Seminar_Agenda[.]htahxxps://my-h3qli6kq[.]pages[.]dev/CrossBorder_Repression_Seminar_Agenda[.]wsfhxxps://my-sv7c1fzs[.]pages[.]dev/Extravaganza%20Latin%20Carnival[.]htahxxps://my-sv7c1fzs[.]pages[.]dev/Extravaganza%20Latin%20Carnival[.]wsfhxxps://my-u0up9qri[.]pages[.]dev/UO%20-C-DAC%20%281%29[.]htahxxps://my-u0up9qri[.]pages[.]dev/UO%20-C-DAC%20%281%29[.]wsfhxxps://my-vtsdod2n[.]pages[.]dev/Extravaganza%20Latin%20Carnival%20post%20copy[.]htahxxps://my-vtsdod2n[.]pages[.]dev/Extravaganza%20Latin%20Carnival%20post%20copy[.]wsfhxxps://my-wgoxp32b[.]pages[.]dev/Internal_Review_Dossier_0520[.]htahxxps://my-wgoxp32b[.]pages[.]dev/Internal_Review_Dossier_0520[.]wsfhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/7ChyKauxbnufxp68[.]jshxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/AcPP9fCvdjztmho8[.]txthxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/KOOOT4a76st012bx[.]txthxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/Ub4RJzNIrfleri8t[.]txthxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3WxnGatherOsState[.]exe[.]mtmhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3WxnOsState[.]dat[.]pgyhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3Wxnslc[.]dll[.]fschxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPGatherOsState[.]exe[.]thlhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPOsState[.]dat[.]mxbhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPslc[.]dll[.]czhhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/oaFE7PJHk0h_emqt[.]txthxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/vD68BdmB2ky28gcc[.]jshxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/0u25lAqY58or53ra[.]jshxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/2laZiB2zvnx04jze[.]jshxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/8ypvQLxJvggmrz94[.]txthxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6ZGatherOsState[.]exe[.]luyhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6ZOsGather[.]dat[.]sykhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6Zslc[.]dll[.]pzshxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HzjNPgRE9ir92e38[.]txthxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/ThyI9pwewrh_a1pr[.]txthxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/gpv0IRMtvto6e8t2[.]txthxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgGatherOsState[.]exe[.]lzjhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgOsGather[.]dat[.]aelhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgslc[.]dll[.]iwqhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/wyLwwCu43j1wf2pg[.]jshxxps://www[.]wps-cn[.]com/downloads/flashcenter_pp_ax_install_en[.]exe

md5 (2)

0173d1566dcd4fd49fa25f11f14bfe4cabfa7742e315485a98a5fafd6dbfb68e

sha256 (63)

01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da502751309ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff0a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec49700b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc7390c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a46417b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4b1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da23d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3ac2f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100c3a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2af3a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02a40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d47f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c65064b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008b4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f5168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005ca5555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db550415a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d8395625c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb61a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da065f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe67702957886a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d53375c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513c7969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b8387c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395c7fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e328e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75f971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf39fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542fa0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221a13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dcad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670ae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585eaea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90b31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40b3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731b75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6b8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85ebd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4c8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800cd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548ad753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bfd87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3ee2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530e2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3fe6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcfe7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bbe809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34f0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1

These observational values were auto-extracted from this report and are not a blocklist or a maliciousness verdict. Values shown are defanged for safe viewing. The analysis artifacts contain live values plus a generated YARA rule; review the source context before use.