iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antino uses Microsoft Graph to turn OneDrive into a place for heartbeats and file transfers, and Outlook into a channel for commands and responses. Cisco Talos tracks the campaign behind the Rust-compiled Windows backdoor as UAT-11587 and assesses with high confidence that it is China-nexus. The activity targeted public-sector and policy organizations across eight countries.
How Antino uses Outlook and OneDrive for command and control
Rather than relying on a dedicated attacker-operated command server, Antino communicates through Microsoft Graph. Its two Microsoft 365 services have separate roles: OneDrive holds host status and transferred files, while Outlook carries operator tasking and implant responses.
| Service and documented location | Role in the channel | Reported cadence or contents |
|---|---|---|
OneDrive: /antino/heartbeats/{id}.json |
Stores implant heartbeat and host telemetry. | Includes session ID, timestamp, online/offline status, machine name, username, platform and campaign code. Gen2 sessions use random UUID v4 identifiers and resend heartbeats every minute. |
OneDrive: /antino_downloads/{file} |
Holds files uploaded from victim systems for operator retrieval. | File-transfer folder; no recurring interval is stated. |
OneDrive: /antino_uploads/{file} |
Holds tools staged by the operator for delivery to victims. | File-transfer folder; no recurring interval is stated. |
Outlook: subjects beginning command_req_[session_id] |
Carries operator commands to an implant. | The implant polls the threat actor’s mailbox approximately every 10 seconds. Message bodies contain JSON fields command_type, command_data and request_id. |
Outlook: subjects beginning command_res_[session_id] |
Carries command responses. | Responses are associated with the implant session ID in the subject. |
Gen2 authenticates with OAuth 2.0 client credentials. The documented network connections terminate at graph.microsoft.com and login.microsoftonline.com, services that may also appear in legitimate enterprise traffic. As a result, spotting connections to those domains alone is not enough to establish malicious activity; defenders need to correlate identity, Graph, mailbox, OneDrive and endpoint evidence.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Who UAT-11587 is and where it operated
UAT-11587 is the campaign cluster name used by Cisco Talos for the operators behind this espionage activity. Talos assesses with high confidence that the cluster is China-nexus, citing the combined technical and operational evidence: Chinese-language metadata and author values, UTC+08:00 artifacts, targeting patterns and repeated use of the China-focused Rust package mirror rsproxy.cn. These are elements of Talos’s overall assessment, not proof that any single artifact identifies an operator.
#1 Best Overall
Talos observed activity from September 2025 through July 2026, with activity accelerating from March through early June 2026. The targeted countries were Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria. Target sectors included defense and national security, central government, diplomacy, justice and border security, legislatures, government IT, universities, think tanks, civil society and policy organizations.
By July 2026, Talos reported at least 10 confirmed and five probable affected institutional environments, plus one additional intended target, and approximately 350 compromised endpoints across the eight countries. During a June 8–9, 2026 wave, it observed around 57 newly seen India-associated endpoints. These are Talos’s campaign figures as of that date, not a measure of the total number of victims or data stolen.
How the infection chain reaches the backdoor
The reported chain starts with tailored spear-phishing and decoy content. It combines cloud-hosted staging, .NET deserialization and DLL sideloading to execute Antino:
- Phishing page: A fake Gmail attachment widget directs the target to Cloudflare Pages.
- Stager delivery: An HTA or WSF file downloads JavaScript from Cloudflare R2 or Amazon CloudFront.
- Loader execution: The script uses custom Base64 handling and RC4 to decrypt resources, then abuses unsafe .NET BinaryFormatter deserialization and gadget chains to load a .NET assembly in
mshta.exe. - Payload setup: A downloader retrieves a decoy document and a DLL-sideloading bundle.
- Antino launch: The Microsoft-signed
GatherOsState.exeloads the adjacentslc.dll, which is the implant.
Talos identified Cloudflare Pages hosting malicious HTA/WSF files and execution tracking, Cloudflare R2 storing encoded loaders, decoys and payload components, and Amazon CloudFront delivering additional scripts and content. Reported software-themed delivery domains included microsoft-flash[.]com and wps-cn[.]com.
What the backdoor can do
Antino is a Rust-compiled Windows backdoor. Talos documented handlers named cmd, powershell, system_info, execute_program, list_files, upload_file, download_file, load_shellcode, add_to_run and exit. Handler availability varies by build.
In practical terms, those functions support host reconnaissance, command-shell and PowerShell execution, arbitrary program execution, file listing and transfer, in-memory shellcode loading, and persistence through a Registry Run value. The combination gives operators a way to collect host details, run additional activity and move files without making the command channel itself look like traffic to an unfamiliar dedicated server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What defenders should monitor in Microsoft 365 and on endpoints
Use the documented behaviors as investigation leads, then validate them against normal tenant and endpoint activity. The reporting does not establish that any one signal is conclusive by itself.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- OAuth and identity: Review unusual OAuth client-credential applications and correlate their identities with unexpected Microsoft Graph access to mail or OneDrive. Check for whether the application, its permissions and its activity fit an approved workload.
- Mailbox activity: Look for repeated access to messages with subjects beginning
command_req_orcommand_res_, especially when linked to an unfamiliar application or endpoint. The approximately 10-second polling pattern is a useful behavioral clue, not a universal detection threshold. - OneDrive activity: Investigate creation or access of the documented
/antino/heartbeat and transfer paths, including the/antino_downloads/and/antino_uploads/folders. Correlate file activity with the identity and application responsible. - Endpoint execution: Review
mshta.exeorwscript.exelaunching cloud-hosted stages, suspicious BinaryFormatter deserialization activity, and a signedGatherOsState.exeloading an adjacentslc.dll. - Cross-source correlation: Join Entra ID, Graph, mailbox and OneDrive events with endpoint process and DLL-load telemetry. A legitimate Microsoft domain or signed executable is not, on its own, evidence of benign behavior.
For an investigation, preserve the relevant application identity, message subjects and timestamps, OneDrive paths and file metadata, endpoint process lineage, and the associated host and user records. This helps establish whether the cloud activity and endpoint execution belong to the same session rather than treating each signal as an isolated alert.
Best Value
What is known about the Jewelbug connection
Talos found overlap between UAT-11587 and Symantec’s Jewelbug activity set, but it could not independently verify a connection between this espionage campaign and Jewelbug’s financially motivated cryptocurrency activity. Talos therefore tracks UAT-11587 separately; the reported overlap should not be treated as confirmation that the same operators conducted both activities.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
