# Antino: A Backdoor With No C2 Server, Because Outlook and OneDrive Are Enough

## Summary

Cisco Talos has published its analysis of **UAT-11587**, a group it assesses as China-nexus with high confidence, targeting government bodies and policy organizations across Asia. As of July 2026: roughly **350 compromised endpoints across eight countries**, with 10 confirmed and 5 probable affected environments.

The primary tool is **Antino**, a backdoor written in Rust. The standout detail: its native C2 channel **operates entirely through Microsoft 365 using Microsoft Graph**. Outlook carries commands, OneDrive carries files and heartbeats. No dedicated C2 server, no unusual domain, no IP to blocklist.

**Priority actions:**

*   Check the DMARC policy on every domain your organization owns. This campaign leans on impersonated organizations having `p=none`.
    
*   Build the ability to monitor Microsoft Graph traffic by source process, because domain blocking does nothing against Antino.
    

## Victimology

![Victimology map](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/antino-map.jpg align="center")

Talos observed targets in **Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria** (moderate-to-high confidence).

Sectors targeted:

*   Defense and national security
    
*   Executive government and foreign affairs
    
*   Justice and law enforcement
    
*   Legislatures
    
*   Government IT
    
*   Policy research institutes and universities
    
*   Civil society and public policy organizations Talos assesses with moderate confidence that the group conducts intelligence gathering. The victim list fits: these are the organizations that hold policy positions, negotiation material and regional security information.
    

## Timeline

![Campaign timeline](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/antino-timeline.jpg align="center")

| Period | Activity |
| --- | --- |
| Sep–Nov 2025 | Philippines-themed lures, delivered as direct attachments |
| Jan 2026 | Two more Philippines HTA campaigns, broader policy lures, a fake-installer branch appears |
| Mar–early Jun 2026 | Acceleration: Philippines and Taiwan first, then Cambodia, Myanmar, Syria, Pakistan, Thailand |
| Jun 8–9, 2026 | Largest wave, roughly 57 newly observed India-associated endpoints |
| Jul 2026 | Last activity in the data set Talos reviewed |

On the tooling side, Antino has two generations: **Gen1 built in October 2025**, **Gen2 from December 2025 to January 2026**.

## Initial Access: Three-Layer Spear-Phishing

![Spear-phishing email sample](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/fig-05-spear-phishing-email.png align="center")

**Layer 1 — spoofing the sender while still passing filters.** Mail was sent through Migadu with `osc-cdn[.]com`, an attacker-controlled domain, as the envelope sender, while the visible From header impersonated a trusted organization. The result: **SPF passed** for the envelope domain, but **DMARC failed** for the displayed one. The message was still delivered, because the impersonated domain's DMARC policy was `p=none`.

This is the most important detail in the delivery chain, and one that some secondary reporting got wrong. The email did not "pass" DMARC — it **failed DMARC and was not blocked**, because the impersonated organization had no enforcement policy.

**Layer 2 — a recreated Gmail attachment widget.** The attackers rebuilt Gmail's familiar attachment card using Base64-inlined PNGs in the HTML, wrapped in a link. The recipient sees what looks like a real attachment but is clicking an outbound link.

**Layer 3 — a protocol-relative link.** The link takes the form `//my-<project>.pages.dev/File_download?m=<target-identifier>`, pointing at Cloudflare Pages. Talos notes this `https:`\-less format may evade tooling that only extracts full http or https URLs. The `?m=` parameter enables per-recipient tracking.

**The lures are carefully built:** an information-warfare workshop agenda and a tax document copied from a Taiwan Ministry of Finance ruling, CSIS Indo-Pacific events, Philippine maritime issues, a Venezuela/Ukraine news story closely paraphrased from AP, and various Indian government topics.

## Infection Chain

![Infection chain](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/antino-chain.jpg align="center")

Talos describes five stages; condensed into three steps:

1.  **Script stager.** The victim opens an HTA or WSF file, run by `mshta.exe` or `WScript`. It hides its window, sends a tracking request, and pulls the next stage from Cloudflare R2 or CloudFront. That stage fetches three encrypted resources, decodes them with a custom Base64 variant, decrypts with RC4, and runs an orchestrator in memory.
    
2.  **.NET deserialization chain.** Gadget chains (`AxHost+State` and `ActivitySurrogateSelector`) load `TestAssembly.dll` **inside the** `mshta.exe` **process**. That component downloads a decoy PDF, opens it for the victim, and downloads a three-file sideload bundle.
    
3.  **DLL sideloading and Antino launch.** `GatherOsState.exe`, a legitimate Microsoft-signed ADK binary, loads the malicious `slc.dll` and calls its `SLOpen` export to start Antino. Installation lands under `%LOCALAPPDATA%\Windows GatherOSStateKit\`. The defensive point: the entire chain runs inside legitimate binaries, with a Microsoft signature present at the final step.
    

## Antino: Capabilities and Configuration

Antino is written in **Rust**, builds for both 32- and 64-bit, and is identifiable by its `AntinoApp` manifest and "antino" paths in PDB and Rust source references.

| Group | Commands |
| --- | --- |
| Host reconnaissance | `system_info`, `list_files` |
| Execution | `cmd`, `powershell`, `execute_program`, `load_shellcode` |
| File transfer | `upload_file` (attacker OneDrive to victim), `download_file` (victim to attacker OneDrive) |
| Persistence | `add_to_run` (creates an HKCU Run value) |

`load_shellcode` runs in memory and includes a **sleep mask**: the payload's memory is encrypted while the implant sleeps, making memory scanning less effective.

Configuration lives in a custom PE section named `.cfg`, with a JSON header XORed using the alternating bytes `0xAB 0xCD`, carrying `run` and `launch_mode` settings.

**Generation differences:**

|  | Gen1 (10/2025) | Gen2 (12/2025–01/2026) |
| --- | --- | --- |
| Session ID | Derived from host data (XOR then Base64) | Random UUIDv4 |
| Registration and heartbeat | Email-based | JSON on OneDrive |
| Authentication | — | OAuth client credentials to Microsoft Graph via an Entra ID app |
| Manifest | — | `AntinoApp` |

## C2 Entirely Through Microsoft 365

This is what defines Antino. Per Talos, the native C2 channel "operates exclusively through Microsoft 365, using Microsoft Graph."

![Antino requesting commands from Outlook](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/data-src-image-e6314374-df80-4cd9-b0e4-0332a270f904.png align="center")

**Outlook as the command channel.** The implant polls the attacker's mailbox **every 10 seconds**:

```plaintext
Command subject:    command_req_[session_id]
Response subject:   command_res_[session_id]
Body: JSON with command_type, command_data, request_id
```

**OneDrive as the file and heartbeat channel:**

```plaintext
/antino/heartbeats/{session_id}.json   # heartbeat at start and roughly every minute
/antino_downloads/                      # data exfiltrated from victims
/antino_uploads/                        # tools staged for victims
```

**The only domains observed** are `graph.microsoft.com` and `login.microsoftonline.com`. For any organization using Microsoft 365, neither can be blocked and neither looks suspicious in proxy logs.

## Abusing Windows Scripted Diagnostics

Antino uses the Windows Scripted Diagnostics framework (`sdiageng.dll`, `sdiagnhost.exe` and the PCW package) to **proxy PowerShell execution and the Run-key change**. PowerShell is therefore not spawned by the malware's own process but by a legitimate system process.

Talos says this "can complicate behavioral attribution" while stressing that **PowerShell, file-creation and registry telemetry remain visible**. The technique breaks the parent-child chains many rules depend on, but it does not remove the actions from the logs.

## Analysis

**Microsoft 365 C2 neutralizes an entire defensive layer.** Domain blocking, reputation filtering, IP and domain TI feeds — none of them have anything to grip. Detection has to shift in two directions. First, **identity signals**: which Entra ID apps authenticate with client credentials, with what permissions, and who granted consent. Second, **process-to-traffic correlation**: which process on the endpoint is calling `graph.microsoft.com`, and whether it has any business doing so.

**Gen1 to Gen2 shows the group learning from its own traces.** Moving session IDs from host-derived values to random UUIDv4 has a clear purpose: the old scheme let defenders correlate victims with each other and infer host details. This group watches how it gets caught and fixes it.

**Good attribution indicators — and signs of loose build hygiene.** Cargo paths referencing `rsproxy.cn`, a Rust mirror used inside mainland China, and the build path `D:\a\antino\antino\...` in GitHub Actions layout. Neither belongs in a release build. They helped Talos attribute the activity and they give defenders durable signatures. Talos also notes that UTC+8 alone is not distinctive, so the attribution rests on the combination of evidence.

**The links to other groups are deliberately cautious, and should be read that way.** Talos sees overlap with Antino-related espionage activity attributed to **Jewelbug** (Symantec), but could not verify a link to Jewelbug's cryptocurrency fraud, so it tracks UAT-11587 separately. The **UNC6384** link rests on a single shared CloudFront distribution and Talos rates it **low confidence**. When rolling these into your own reporting, do not upgrade them into assertions.

**The DMARC** `p=none` **problem belongs to the impersonated party, not the recipient.** This campaign spoofed trusted organizations and the mail landed because those organizations had no enforcement policy. It is a risk an organization creates for its partners and constituents, not for its own systems.

## Relevance to Vietnam

**Vietnam does not appear in the victim list Talos published.** But reading that list closely, the context sits very close:

*   **Neighbors and regional peers were targeted:** the Philippines, Cambodia, Thailand, Myanmar. Lures about maritime issues and Indo-Pacific policy events cover subjects Vietnamese agencies also follow closely.
    
*   **The targeted sectors match Vietnam's own surface:** foreign affairs, legislatures, policy research institutes and universities. "Workshop agenda" and "internal document" lures fit exactly how these organizations receive external mail.
    
*   **DMARC** `p=none` **remains widespread** across Vietnamese government and corporate domains. That means your domain can be used to impersonate you in a campaign against your partners while your own systems see nothing at all.
    
*   **Microsoft 365 is widely deployed**, so traffic to `graph.microsoft.com` is normal everywhere. Without a per-process baseline, this C2 channel is effectively invisible.
    
*   `mshta.exe` **is usually unrestricted.** Many environments still allow HTA execution out of concern for legacy internal applications. That is step one of the entire chain.
    

## Recommendations

*   **Move DMARC to** `p=quarantine` **and then** `p=reject` on every domain your organization owns, including domains that never send mail. This protects your partners and constituents from being phished in your name.
    
*   **Monitor Microsoft Graph by source process:** alert when a process that is not an Office client or browser opens connections to `graph.microsoft.com` or `login.microsoftonline.com`. Also audit Entra ID apps authenticating with client credentials and the permissions granted to them.
    
*   **Block or restrict** `mshta.exe` **and Windows Script Host** via AppLocker, WDAC or ASR rules. Where a full block is impossible, at minimum alert when they run from user directories or create network connections.
    
*   **Sideloading detection:** `GatherOsState.exe` loading `slc.dll` from a user-writable directory, and more generally any signed binary loading a DLL from outside its standard install path.
    
*   **Detect Scripted Diagnostics abuse:** `sdiagnhost.exe` running with `-Embedding`, and PowerShell spawned from `sdiagnhost.exe`. Talos confirms this telemetry survives even though the parent-child chain is broken.
    
*   **Handle email more thoroughly at the gateway:** extract protocol-relative links (`//domain/...`) as well as full URLs, and treat a DMARC failure as actionable even when the sending domain's policy is `p=none`.
    

## IOCs

> Talos published roughly 80 hashes. Below is the operationally highest-value selection. The full set is in the [Cisco Talos IOC repository](https://github.com/Cisco-Talos/IOCs/blob/main/2026/09/uat-11587-targets-gov.txt).

**Domains**

```plaintext
osc-cdn[.]com                                      # spoofed envelope sender
microsoft-flash[.]com                              # fake installer
wps-cn[.]com                                       # fake installer
d2nq35tel3ucuo[.]cloudfront[.]net                  # staging
d32tpl7xt7175h[.]cloudfront[.]net                  # overlaps UNC6384 (low confidence)
pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev    # staging
pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev    # staging
oisadjfoinsiduhfnoisdnfosdnoifnsoid[.]pages[.]dev  # tracking
```

Cloudflare Pages projects used for delivery, all under `.pages[.]dev`:

```plaintext
my-3lyt6wcp   my-qc39r814   my-662ylt3w   my-6g16qsfe   my-goq6xmbm
my-h3qli6kq   my-sv7c1fzs   my-u0up9qri   my-vtsdod2n   my-wgoxp32b
```

**IP address**

```plaintext
103[.]27[.]110[.]220    # historical serving IP for the Antino payload on wps-cn[.]com
```

**Representative URLs**

```plaintext
hxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en.exe
hxxps://www[.]wps-cn[.]com/downloads/flashcenter_pp_ax_install_en.exe
hxxps://my-662ylt3w[.]pages[.]dev/Institutional_Disciplinary_Action_Report_May_2026.hta
hxxps://my-goq6xmbm[.]pages[.]dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta
hxxps://my-wgoxp32b[.]pages[.]dev/Internal_Review_Dossier_0520.hta
```

**Representative hashes (SHA-256)**

```plaintext
e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34  # HTA stager
e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf  # HTA stager
4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f  # HTA stager
d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf  # TestAssembly.dll
1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da  # Antino Gen1 slc.dll
09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff  # Antino Gen2 slc.dll
0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd  # Gen2 fake installer
```

**Host-based**

```plaintext
%LOCALAPPDATA%\Windows GatherOSStateKit\      # installation directory
C:\Windows\Temp\SDIAG_<GUID>                  # Scripted Diagnostics artifacts
GatherOsState.exe                             # abused legitimate ADK binary
slc.dll                                       # Antino
OsGather.dat                                  # calculator decoy PE
HKCU Run                                      # value created by add_to_run
```

Downloaded payloads are renamed to unusual extensions: `.luy`, `.pzs`, `.syk`, `.lzj`, `.iwq`, `.ael`, `.thl`, `.czh`, `.mxb`, `.mtm`, `.fsc`, `.pgy`.

**Hunting markers**

```plaintext
AssemblyAttribute GUID: b2b3adb0-1669-4b94-86cb-6dd682ddbea3   # in TestAssembly.dll builds
Build path:             D:\a\antino\antino\...                 # GitHub Actions layout
Manifest:               AntinoApp
Config PE section:      .cfg (JSON header XORed with 0xAB 0xCD)
```

**Existing coverage:** ClamAV signatures (`Win.Trojan.UAT-11587-10060365-1` through `-10060384-1`, plus HTML and text variants), and Snort 2/3 rules `1:66880`, `1:66881`, `1:66882`.

## References

*   Cisco Talos (Ashley Shen) — *China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor* (30/09/2026): https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/
    
*   Cisco Talos — IOC repository: https://github.com/Cisco-Talos/IOCs/blob/main/2026/09/uat-11587-targets-gov.txt
    
*   The Hacker News (Ravie Lakshmanan) — *Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign* (02/10/2026): https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html
    
*   Symantec and Carbon Black — Jewelbug research (08/2026)
    
*   Arctic Wolf — UNC6384 research