Antino: A Backdoor With No C2 Server, Because Outlook and OneDrive Are Enough

Summary

Cisco Talos has published its analysis of UAT-11587, a group it assesses as China-nexus with high confidence, targeting government bodies and policy organizations across Asia. As of July 2026: roughly 350 compromised endpoints across eight countries, with 10 confirmed and 5 probable affected environments.

The primary tool is Antino, a backdoor written in Rust. The standout detail: its native C2 channel operates entirely through Microsoft 365 using Microsoft Graph. Outlook carries commands, OneDrive carries files and heartbeats. No dedicated C2 server, no unusual domain, no IP to blocklist.

Priority actions:

• Check the DMARC policy on every domain your organization owns. This campaign leans on impersonated organizations having p=none.

• Build the ability to monitor Microsoft Graph traffic by source process, because domain blocking does nothing against Antino.

Victimology

Talos observed targets in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria (moderate-to-high confidence).

Sectors targeted:

• Defense and national security

• Executive government and foreign affairs

• Justice and law enforcement

• Legislatures

• Government IT

• Policy research institutes and universities

• Civil society and public policy organizations Talos assesses with moderate confidence that the group conducts intelligence gathering. The victim list fits: these are the organizations that hold policy positions, negotiation material and regional security information.

Timeline

Period	Activity
Sep–Nov 2025	Philippines-themed lures, delivered as direct attachments
Jan 2026	Two more Philippines HTA campaigns, broader policy lures, a fake-installer branch appears
Mar–early Jun 2026	Acceleration: Philippines and Taiwan first, then Cambodia, Myanmar, Syria, Pakistan, Thailand
Jun 8–9, 2026	Largest wave, roughly 57 newly observed India-associated endpoints
Jul 2026	Last activity in the data set Talos reviewed

On the tooling side, Antino has two generations: Gen1 built in October 2025, Gen2 from December 2025 to January 2026.

Initial Access: Three-Layer Spear-Phishing

Layer 1 — spoofing the sender while still passing filters. Mail was sent through Migadu with osc-cdn[.]com, an attacker-controlled domain, as the envelope sender, while the visible From header impersonated a trusted organization. The result: SPF passed for the envelope domain, but DMARC failed for the displayed one. The message was still delivered, because the impersonated domain's DMARC policy was p=none.

This is the most important detail in the delivery chain, and one that some secondary reporting got wrong. The email did not "pass" DMARC — it failed DMARC and was not blocked, because the impersonated organization had no enforcement policy.

Layer 2 — a recreated Gmail attachment widget. The attackers rebuilt Gmail's familiar attachment card using Base64-inlined PNGs in the HTML, wrapped in a link. The recipient sees what looks like a real attachment but is clicking an outbound link.

Layer 3 — a protocol-relative link. The link takes the form //my-<project>.pages.dev/File_download?m=<target-identifier>, pointing at Cloudflare Pages. Talos notes this https:-less format may evade tooling that only extracts full http or https URLs. The ?m= parameter enables per-recipient tracking.

The lures are carefully built: an information-warfare workshop agenda and a tax document copied from a Taiwan Ministry of Finance ruling, CSIS Indo-Pacific events, Philippine maritime issues, a Venezuela/Ukraine news story closely paraphrased from AP, and various Indian government topics.

Infection Chain

Talos describes five stages; condensed into three steps:

1. Script stager. The victim opens an HTA or WSF file, run by mshta.exe or WScript. It hides its window, sends a tracking request, and pulls the next stage from Cloudflare R2 or CloudFront. That stage fetches three encrypted resources, decodes them with a custom Base64 variant, decrypts with RC4, and runs an orchestrator in memory.

2. .NET deserialization chain. Gadget chains (AxHost+State and ActivitySurrogateSelector) load TestAssembly.dll inside the mshta.exe process. That component downloads a decoy PDF, opens it for the victim, and downloads a three-file sideload bundle.

3. DLL sideloading and Antino launch. GatherOsState.exe, a legitimate Microsoft-signed ADK binary, loads the malicious slc.dll and calls its SLOpen export to start Antino. Installation lands under %LOCALAPPDATA%\Windows GatherOSStateKit\. The defensive point: the entire chain runs inside legitimate binaries, with a Microsoft signature present at the final step.

Antino: Capabilities and Configuration

Antino is written in Rust, builds for both 32- and 64-bit, and is identifiable by its AntinoApp manifest and "antino" paths in PDB and Rust source references.

Group	Commands
Host reconnaissance	system_info, list_files
Execution	cmd, powershell, execute_program, load_shellcode
File transfer	upload_file (attacker OneDrive to victim), download_file (victim to attacker OneDrive)
Persistence	add_to_run (creates an HKCU Run value)

load_shellcode runs in memory and includes a sleep mask: the payload's memory is encrypted while the implant sleeps, making memory scanning less effective.

Configuration lives in a custom PE section named .cfg, with a JSON header XORed using the alternating bytes 0xAB 0xCD, carrying run and launch_mode settings.

Generation differences:

	Gen1 (10/2025)	Gen2 (12/2025–01/2026)
Session ID	Derived from host data (XOR then Base64)	Random UUIDv4
Registration and heartbeat	Email-based	JSON on OneDrive
Authentication	—	OAuth client credentials to Microsoft Graph via an Entra ID app
Manifest	—	AntinoApp

C2 Entirely Through Microsoft 365

This is what defines Antino. Per Talos, the native C2 channel "operates exclusively through Microsoft 365, using Microsoft Graph."

Outlook as the command channel. The implant polls the attacker's mailbox every 10 seconds:

Command subject:    command_req_[session_id]
Response subject:   command_res_[session_id]
Body: JSON with command_type, command_data, request_id

OneDrive as the file and heartbeat channel:

/antino/heartbeats/{session_id}.json   # heartbeat at start and roughly every minute
/antino_downloads/                      # data exfiltrated from victims
/antino_uploads/                        # tools staged for victims

The only domains observed are graph.microsoft.com and login.microsoftonline.com. For any organization using Microsoft 365, neither can be blocked and neither looks suspicious in proxy logs.

Abusing Windows Scripted Diagnostics

Antino uses the Windows Scripted Diagnostics framework (sdiageng.dll, sdiagnhost.exe and the PCW package) to proxy PowerShell execution and the Run-key change. PowerShell is therefore not spawned by the malware's own process but by a legitimate system process.

Talos says this "can complicate behavioral attribution" while stressing that PowerShell, file-creation and registry telemetry remain visible. The technique breaks the parent-child chains many rules depend on, but it does not remove the actions from the logs.

Analysis

Microsoft 365 C2 neutralizes an entire defensive layer. Domain blocking, reputation filtering, IP and domain TI feeds — none of them have anything to grip. Detection has to shift in two directions. First, identity signals: which Entra ID apps authenticate with client credentials, with what permissions, and who granted consent. Second, process-to-traffic correlation: which process on the endpoint is calling graph.microsoft.com, and whether it has any business doing so.

Gen1 to Gen2 shows the group learning from its own traces. Moving session IDs from host-derived values to random UUIDv4 has a clear purpose: the old scheme let defenders correlate victims with each other and infer host details. This group watches how it gets caught and fixes it.

Good attribution indicators — and signs of loose build hygiene. Cargo paths referencing rsproxy.cn, a Rust mirror used inside mainland China, and the build path D:\a\antino\antino\... in GitHub Actions layout. Neither belongs in a release build. They helped Talos attribute the activity and they give defenders durable signatures. Talos also notes that UTC+8 alone is not distinctive, so the attribution rests on the combination of evidence.

The links to other groups are deliberately cautious, and should be read that way. Talos sees overlap with Antino-related espionage activity attributed to Jewelbug (Symantec), but could not verify a link to Jewelbug's cryptocurrency fraud, so it tracks UAT-11587 separately. The UNC6384 link rests on a single shared CloudFront distribution and Talos rates it low confidence. When rolling these into your own reporting, do not upgrade them into assertions.

The DMARC p=none problem belongs to the impersonated party, not the recipient. This campaign spoofed trusted organizations and the mail landed because those organizations had no enforcement policy. It is a risk an organization creates for its partners and constituents, not for its own systems.

Relevance to Vietnam

Vietnam does not appear in the victim list Talos published. But reading that list closely, the context sits very close:

• Neighbors and regional peers were targeted: the Philippines, Cambodia, Thailand, Myanmar. Lures about maritime issues and Indo-Pacific policy events cover subjects Vietnamese agencies also follow closely.

• The targeted sectors match Vietnam's own surface: foreign affairs, legislatures, policy research institutes and universities. "Workshop agenda" and "internal document" lures fit exactly how these organizations receive external mail.

• DMARC p=none remains widespread across Vietnamese government and corporate domains. That means your domain can be used to impersonate you in a campaign against your partners while your own systems see nothing at all.

• Microsoft 365 is widely deployed, so traffic to graph.microsoft.com is normal everywhere. Without a per-process baseline, this C2 channel is effectively invisible.

• mshta.exe is usually unrestricted. Many environments still allow HTA execution out of concern for legacy internal applications. That is step one of the entire chain.

Recommendations

• Move DMARC to p=quarantine and then p=reject on every domain your organization owns, including domains that never send mail. This protects your partners and constituents from being phished in your name.

• Monitor Microsoft Graph by source process: alert when a process that is not an Office client or browser opens connections to graph.microsoft.com or login.microsoftonline.com. Also audit Entra ID apps authenticating with client credentials and the permissions granted to them.

• Block or restrict mshta.exe and Windows Script Host via AppLocker, WDAC or ASR rules. Where a full block is impossible, at minimum alert when they run from user directories or create network connections.

• Sideloading detection: GatherOsState.exe loading slc.dll from a user-writable directory, and more generally any signed binary loading a DLL from outside its standard install path.

• Detect Scripted Diagnostics abuse: sdiagnhost.exe running with -Embedding, and PowerShell spawned from sdiagnhost.exe. Talos confirms this telemetry survives even though the parent-child chain is broken.

• Handle email more thoroughly at the gateway: extract protocol-relative links (//domain/...) as well as full URLs, and treat a DMARC failure as actionable even when the sending domain's policy is p=none.

IOCs

Talos published roughly 80 hashes. Below is the operationally highest-value selection. The full set is in the Cisco Talos IOC repository.

Domains

osc-cdn[.]com                                      # spoofed envelope sender
microsoft-flash[.]com                              # fake installer
wps-cn[.]com                                       # fake installer
d2nq35tel3ucuo[.]cloudfront[.]net                  # staging
d32tpl7xt7175h[.]cloudfront[.]net                  # overlaps UNC6384 (low confidence)
pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev    # staging
pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev    # staging
oisadjfoinsiduhfnoisdnfosdnoifnsoid[.]pages[.]dev  # tracking

Cloudflare Pages projects used for delivery, all under .pages[.]dev:

my-3lyt6wcp   my-qc39r814   my-662ylt3w   my-6g16qsfe   my-goq6xmbm
my-h3qli6kq   my-sv7c1fzs   my-u0up9qri   my-vtsdod2n   my-wgoxp32b

IP address

103[.]27[.]110[.]220    # historical serving IP for the Antino payload on wps-cn[.]com

Representative URLs

hxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en.exe
hxxps://www[.]wps-cn[.]com/downloads/flashcenter_pp_ax_install_en.exe
hxxps://my-662ylt3w[.]pages[.]dev/Institutional_Disciplinary_Action_Report_May_2026.hta
hxxps://my-goq6xmbm[.]pages[.]dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta
hxxps://my-wgoxp32b[.]pages[.]dev/Internal_Review_Dossier_0520.hta

Representative hashes (SHA-256)

e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34  # HTA stager
e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf  # HTA stager
4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f  # HTA stager
d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf  # TestAssembly.dll
1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da  # Antino Gen1 slc.dll
09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff  # Antino Gen2 slc.dll
0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd  # Gen2 fake installer

Host-based

%LOCALAPPDATA%\Windows GatherOSStateKit\      # installation directory
C:\Windows\Temp\SDIAG_<GUID>                  # Scripted Diagnostics artifacts
GatherOsState.exe                             # abused legitimate ADK binary
slc.dll                                       # Antino
OsGather.dat                                  # calculator decoy PE
HKCU Run                                      # value created by add_to_run

Downloaded payloads are renamed to unusual extensions: .luy, .pzs, .syk, .lzj, .iwq, .ael, .thl, .czh, .mxb, .mtm, .fsc, .pgy.

Hunting markers

AssemblyAttribute GUID: b2b3adb0-1669-4b94-86cb-6dd682ddbea3   # in TestAssembly.dll builds
Build path:             D:\a\antino\antino\...                 # GitHub Actions layout
Manifest:               AntinoApp
Config PE section:      .cfg (JSON header XORed with 0xAB 0xCD)

Existing coverage: ClamAV signatures (Win.Trojan.UAT-11587-10060365-1 through -10060384-1, plus HTML and text variants), and Snort 2/3 rules 1:66880, 1:66881, 1:66882.

References

• Cisco Talos (Ashley Shen) — China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor (30/09/2026): https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/

• Cisco Talos — IOC repository: https://github.com/Cisco-Talos/IOCs/blob/main/2026/09/uat-11587-targets-gov.txt

• The Hacker News (Ravie Lakshmanan) — Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign (02/10/2026): https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html

• Symantec and Carbon Black — Jewelbug research (08/2026)

• Arctic Wolf — UNC6384 research