Date: October 6, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Cyber Espionage / Malware Analysis / Advanced Persistent Threat / Cloud Security
Tags: UAT-11587, Antino, China, APT, Cisco Talos, Check Point, Microsoft 365, Cloud C2, Rust
Executive Summary
In early October 2026, cybersecurity research teams from Cisco Talos, Check Point Research, and The Hacker News published comprehensive technical analyses exposing a state-sponsored cyber espionage campaign orchestrated by the China-nexus threat cluster UAT-11587 (also linked to espionage activity tracked as Jewelbug).
The campaign specifically targeted governmental bodies, foreign affairs ministries, and public policy organizations across Asia. The threat actors deployed Antino, a newly identified modular backdoor compiled in the Rust programming language. What distinguishes Antino from conventional malware is its complete reliance on legitimate Microsoft 365 cloud infrastructure—specifically Microsoft Outlook and OneDrive—for its command-and-control (C2) communications. By routing command execution and data exfiltration entirely through encrypted Microsoft Graph APIs, the malware blends seamlessly into standard enterprise cloud traffic, evading perimeter firewalls, network intrusion detection systems, and cloud proxy filters.
Technical Deep-Dive: Analyzing the Antino Backdoor Architecture
The Antino intrusion chain represents a masterclass in living-off-the-cloud tradecraft:
1. Initial Access via Weaponized Decoy Documents
The infection vector relies on tailored spear-phishing emails sent to diplomatic and government personnel:
* The Geopolitical Pretext: Phishing messages carry malicious archive attachments containing geopolitical and foreign policy documents relevant to regional diplomatic summits and trade agreements.
* Executable Disguise: The archive contains a disguised executable using double extensions (e.g., ASEAN_Policy_Framework_2026.pdf.exe) alongside an embedded benign decoy PDF that opens automatically upon execution to prevent victim suspicion.
2. Rust-Compiled Architecture & EDR Evasion
Antino is authored entirely in Rust, providing significant defensive evasion benefits:
* Cross-Architecture Efficiency: The compiled Rust binary exhibits complex control-flow graphs, non-standard memory layouts, and inline string obfuscation, hindering automated static decompilation and signature matching.
* Direct System Call Invocation: Antino avoids standard Windows API wrappers, utilizing dynamic resolution and direct system calls to inject code into legitimate operating system processes (such as svchost.exe and explorer.exe).
3. Microsoft 365 as an In-Memory C2 Communication Channel
Antino's most sophisticated architectural innovation is its command-and-control subsystem, which operates entirely within legitimate Microsoft 365 tenant endpoints:
* Hardcoded OAuth Application Credentials: The backdoor contains embedded client IDs, tenant IDs, and encrypted secret tokens registered under legitimate Microsoft Azure applications.
* Command Dispatch via Microsoft Outlook: To receive operator instructions, Antino queries a dedicated, compromised Outlook mailbox via the Microsoft Graph REST API. The operator sends tasking commands formatted as encrypted email drafts or inbox messages. Antino fetches the unread email, decrypts the command payload, and marks the message as read or deletes it.
* Data Exfiltration via Microsoft OneDrive: When commanded to exfiltrate files or keystroke logs, Antino uploads encrypted archives directly into a pre-configured Microsoft OneDrive directory via HTTPS port 443.
4. Post-Exploitation Capabilities & Lateral Movement
Once established on a government workstation, Antino executes modular tasks:
* Automated Reconnaissance: Collects host network interfaces, domain controller details, active processes, and installed security software.
* Interactive Command Execution: Spawns reverse command prompts, executing arbitrary PowerShell and batch commands.
* File Theft: Recursively searches local drives and connected network shares for documents matching targeted extensions (.docx, .xlsx, .pdf, .msg, .pptx).
* Persistence via Scheduled Tasks: Establishes persistent startup scheduled tasks masked under legitimate Windows telemetry names.
Threat Intelligence Parameter
Forensic Detail
Threat Cluster
UAT-11587 (Overlaps with Jewelbug / Mustang Panda)
Attribution
China-nexus state-sponsored cyber espionage syndicate
Primary Target Sector
Foreign Ministries, Government Policy Bodies, Defense Think Tanks across Asia
Malware Name
Antino Backdoor
Development Language
Rust (64-bit Windows PE)
Command & Control Medium
Microsoft 365 Cloud APIs (Microsoft Outlook for tasking, OneDrive for exfiltration)
Traffic Characteristics
Outbound HTTPS (port 443) to graph.microsoft.com (Completely legitimate domain)
Investigating Agencies
Cisco Talos Intelligence Group & Check Point Research
The Challenge of Living-off-the-Cloud (LotC) Tradecraft
Antino exemplifies the growing trend of threat actors moving away from dedicated attacker-controlled domains in favor of trusted cloud platforms:
* Perimeter Firewalls Blinded: Because almost every enterprise permits unrestricted HTTPS outbound traffic to graph.microsoft.com and login.microsoftonline.com, perimeter firewalls and secure web gateways cannot block C2 traffic without breaking legitimate Microsoft 365 productivity tools.
* SSL/TLS Encryption Shielding: The command traffic is protected by authentic Microsoft TLS certificates, preventing deep packet inspection unless TLS decryption is strictly enforced with granular Graph API inspection.
Recommendations and Mitigations
Government agencies, enterprise organizations, and defense contractors should deploy the following countermeasures:
1. Implement Cloud Application Control & Graph API Auditing:
* Restrict corporate endpoint access to Microsoft Graph API so that devices can communicate only with approved, sanctioned organizational tenant IDs.
* Block outgoing authentication requests to foreign, unapproved Azure App Registrations using Microsoft Entra ID Conditional Access.
2. Monitor Endpoint Process Network Connections to Microsoft Graph:
* Hunt for non-browser, unexpected processes (e.g., unsigned binaries or processes running from %APPDATA% or %TEMP%) initiating outbound TCP connections to graph.microsoft.com.
3. Deploy Rust-Aware Behavioral EDR Detection:
* Configure EDR rules that flag direct system call invocation and unusual in-memory thread injection into system binaries like svchost.exe.
4. Enforce Strict Email Gateway Attachment Inspection:
* Block incoming emails containing double-extension executable archives (.zip or .iso containing .exe) and inspect macro-enabled or decoy PDF attachments in isolated sandbox environments.