Date: October 3, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Advanced Persistent Threats / Cyber Espionage / Malware Analysis / Cloud Security / Living-off-the-Cloud
Tags: Antino, UAT-11587, Cisco Talos, Jewelbug, Rust Backdoor, Microsoft 365, Outlook, OneDrive, Microsoft Graph API, Living-off-the-Cloud, APT
Executive Summary
In a striking demonstration of how advanced persistent threat (APT) groups are abandoning dedicated command-and-control (C2) servers in favor of legitimate enterprise software-as-a-service (SaaS) infrastructure, cybersecurity researchers on October 3, 2026, disclosed a wide-ranging cyber espionage campaign targeting critical government and policy institutions across the Indo-Pacific region. As revealed by Cisco Talos Intelligence and reported by The Hacker News and SOC Prime, the state-sponsored threat cluster tracked as UAT-11587 (linked to Chinese espionage operations and sharing operational overlaps with Jewelbug) has breached at least 16 organizations across eight Asian nations—including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar.
At the center of this campaign is Antino, a newly discovered, custom-engineered backdoor written in the Rust programming language.
Antino pushes Living-off-the-Cloud (LotC) tradecraft to new heights by routing its entire operational lifecycle through Microsoft 365 services via the Microsoft Graph API. The malware uses Microsoft Outlook mailboxes as an asynchronous command exchange terminal and Microsoft OneDrive storage accounts for heartbeat status beacons and staging exfiltrated corporate documents. Because all egress network connections terminate at legitimate, trusted Microsoft cloud endpoints (graph.microsoft.com), traditional perimeter firewalls, network intrusion detection systems (NIDS), and secure web gateways (SWGs) remain blind to the active intrusion.
Technical Deep-Dive: Deconstructing the Antino Backdoor & M365 C2 Mechanism
To evaluate the operational stealth of Antino, we analyze its Rust binary architecture, its automated build pipeline, and the step-by-step mechanics of its Microsoft Graph API command-and-control engine.
Phase
Source / Endpoint
Mechanism / API Call
Description
1. Authentication
Endpoint $\rightarrow$ Entra ID
POST login.microsoftonline.com
Exchanges embedded OAuth 2.0 credentials for a valid Graph API Bearer Token.
2. Heartbeat
Endpoint $\rightarrow$ OneDrive
PUT /v1.0/me/drive/root:/heartbeat:/content
Encodes host telemetry (PID, hostname, OS) and writes status to storage.
3. Operator Read
Operator $\leftarrow$ OneDrive
M365 Web / API Access
Operator checks OneDrive heartbeat logs to confirm agent readiness.
4. Tasking
Operator $\rightarrow$ Outlook
Standard Mail Delivery
Operator sends encrypted command emails to the monitored mailbox.
5. Command Retrieval
Endpoint $\leftarrow$ Outlook
GET /v1.0/me/mailFolders/inbox/messages
Backdoor polls inbox via Graph API, executes payload, and purges email.
6. Execution
Local System
Native Process Execution
Executes PowerShell/Shellcode in-memory; clears temporary task traces.
7. Exfiltration
Endpoint $\rightarrow$ OneDrive
PUT /v1.0/me/drive/root:/exfil/data.zip
Encrypts and uploads harvested staging files directly to M365 cloud.
8. Intelligence Collection
Operator $\leftarrow$ OneDrive
M365 Web / API Access
Operator downloads exfiltrated victim data directly from OneDrive storage.
1. Binary Architecture: Modern Rust Tooling & CI/CD Pipelines
Antino reflects a growing trend among top-tier APT groups migrating away from legacy C/C++ malware to memory-safe, cross-platform compiled languages:
* Rust Implementation: Observed in both 32-bit and 64-bit Windows PE formats (executables and DLLs), Antino leverages Rust's built-in concurrency, strong static typing, and complex standard library structures to frustrate reverse engineers and evade heuristic antivirus signatures.
* Artifact Nomenclature: Talos named the malware family based on the internal Windows application manifest identifying the binary as AntinoApp, along with embedded source directory references.
* Weaponized CI/CD Infrastructure: Debug paths extracted from analyzed binaries revealed strings conforming to standard GitHub Actions runner environments: D:\a\antino\antino\src\... This confirms that UAT-11587 utilizes automated continuous integration (CI) workflows on public developer platforms to compile and package specialized malware builds against target victim architectures.
2. Living-off-the-Cloud (LotC) C2 via Microsoft Graph API
Traditional malware relies on attacker-registered dynamic DNS domains or virtual private servers (VPS) that can be identified via threat intelligence feeds and blocked at firewall perimeters. Antino completely circumvents this paradigm:
* OAuth 2.0 Credential Provisioning: The backdoor embeds hardcoded application credentials (Client ID, Tenant ID, and Client Secret) tied to an attacker-controlled Microsoft Entra ID (Azure AD) enterprise application registration.
* Command Retrieval via Outlook:
* The backdoor issues HTTPS requests to Microsoft Graph endpoints: GET https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messages
* It searches for unread emails containing a specific subject tag or sender address.
* The email body contains Base64-encoded, XOR-encrypted instructions (such as shell commands, download URLs, or secondary payloads).
* After executing the command, Antino moves or deletes the email message via the Graph API to ensure the mailbox appears pristine and leaves no visual trace for administrators.
* Heartbeat & Staging via OneDrive:
* For persistence and telemetry, Antino interacts with the Microsoft OneDrive API: PUT https://graph.microsoft.com/v1.0/me/drive/root:/telemetry/
* When the operators task the backdoor to exfiltrate documents, Antino compresses and encrypts the files locally, then uploads them directly to the OneDrive drive folder, utilizing Microsoft's hyperscale storage as an untraceable exfiltration repository.
3. Execution Primitives and Host Capabilities
Beyond its covert C2 engine, Antino is equipped with a versatile suite of post-exploitation modules:
* In-Memory Shellcode Injection: Allocates virtual memory blocks using native Windows APIs (VirtualAlloc, WriteProcessMemory, CreateRemoteThread) to inject and execute secondary shellcode in memory, preventing binary signatures from touching disk.
* Process & Shell Orchestration: Spawns interactive cmd.exe and powershell.exe subprocesses with redirected standard input/output streams, returning execution outputs to the operators via M365.
* Persistence Mechanisms: Establishes persistence via Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) or by masquerading as scheduled tasks under benign system maintenance names.
Industry Impact: The Trust Paradox of Cloud Infrastructure
The deployment of Antino underscores an acute strategic vulnerability in modern enterprise network defense:
* The Blindness of Perimeter Security: Enterprise security stacks are heavily tuned to inspect traffic to unknown or suspicious domains. However, traffic to graph.microsoft.com and login.microsoftonline.com is explicitly whitelisted across corporate proxies and firewalls to allow routine productivity workflows (Outlook, Teams, SharePoint).
* Abuse of Legitimate SaaS Ecosystems: By weaponizing enterprise-trusted platforms, threat actors achieve persistent access with virtually zero infrastructure setup costs, no exposure of malicious IP addresses, and immunity to domain takedowns.
Defensive Hardening Blueprint & Threat Hunting
To defend against Living-off-the-Cloud threats abusing Microsoft 365, security architects and SOC analysts should deploy the following controls:
1. Enforce Microsoft Entra Tenant Restrictions
The most effective mitigation against unauthorized M365 API abuse is configuring Tenant Restrictions:
* Configure enterprise edge proxies (e.g., Zscaler, Palo Alto, Squid) to inject HTTP headers into all outbound traffic destined for login.microsoftonline.com:
* Restrict-Access-To-Tenants:
* Restrict-Access-Context:
* This policy instructs Microsoft’s identity platform to block any authentication attempt originating from your network to foreign, personal, or attacker-controlled Microsoft tenants, instantly neutralizing Antino's C2 connection.
2. Audit Third-Party Application Consents & App Registrations
* Regularly review all application registrations and enterprise applications within Microsoft Entra ID.
* Restrict unprivileged users from granting consent to applications requesting sensitive Microsoft Graph API scopes (e.g., Mail.ReadWrite, Files.ReadWrite.All, Mail.Send).
* Enforce admin consent workflows for any third-party application requesting access to mailboxes or cloud storage.
3. Threat Hunting & Behavioral Detection
* Process-Level Network Telemetry: Monitor endpoints for non-browser, non-Office processes initiating direct HTTPS connections to graph.microsoft.com. Standard worker binaries (svchost.exe, arbitrary user-space binaries in AppData) communicating directly with Graph endpoints represent high-confidence indicators of malicious LotC activity.
* YARA Signature Detection: Scan endpoint storage and memory pools for Antino strings:
* Strings matching AntinoApp, antino_client, or debug paths containing \antino\antino\src\.
* PE files importing Rust runtime libraries while containing embedded Microsoft OAuth authorization endpoint URLs.
For cyber espionage threat intelligence, malware reverse engineering, and cloud defense blueprints, subscribe to Digital Spying.