Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

The Antino backdoor, attributed to the China-nexus group UAT-11587, exploits legitimate Microsoft 365 services — Outlook and OneDrive — as command-and-control channels, allowing malicious traffic to blend seamlessly with trusted business communications. This technique is particularly dangerous because most organizations whitelist Microsoft services at the network perimeter, effectively neutralizing traditional C2 detection methods. The campaign targeting government and policy organizations highlights how nation-state actors increasingly 'live off the land' using trusted cloud infrastructure to evade detection. Without granular monitoring of API-level behavior and anomalous cloud service usage patterns, defenders have limited visibility into this class of threat. The use of Rust-compiled malware also increases resilience against reverse engineering and behavioral detection.