[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIHSze5pUsfC0T69DFkg-0vDHwF0FVBaFNOfPZf80xD4":3},{"article":4,"iocs":53,"watch_terms":61,"solutions":62,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"5511d57e-9721-44fa-afaa-836429b762f6","Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign","antino-backdoor-uses-outlook-and-onedrive-for-c2-in-china-nexus-espionage-campai-2fb0ab","Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor codenamed Antino. Cisco Talos is tracking the cluster","A China-nexus threat actor, tracked as UAT-11587 by Cisco Talos, is conducting an espionage campaign against government and policy organizations across Asia using a new backdoor named Antino. The malware, compiled in Rust, leverages Microsoft 365 services like Outlook and OneDrive for command and control. The campaign, which began in September 2025, has expanded to target entities in eight Asian countries and shows potential links to other China-aligned threat groups.","China-nexus actor deploys new Antino backdoor targeting Asian government and policy organizations.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fantino-backdoor-uses-outlook-and.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjE3s79KuB4kHE3Kf6kjA84HqdcQ2TTVyJCgIkLcSnpbMr6vCwjaLjJVE1KiXT2lZfcx_CbKlHjiX9PrEppf53uaTvQ_Vyicl447mGIkdz1ZOzmGR1hPJzgODM2J_lnsbKPhTBvvTgdDcSS4V1JzJ-feSpyJFDyDkKS0BfK7AXTCNWaL9DZ60tmWVysyVo0\u002Fs1600\u002Fms-cyber.jpg","2026-10-02T17:33:16+00:00","2026-10-02T18:00:11.7031+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"UAT-11587","threat_actor",{"name":21,"type":19},"Jewelbug",{"name":23,"type":19},"CL-STA-0049",{"name":25,"type":19},"Earth Alux",{"name":27,"type":19},"Ink Dragon",{"name":29,"type":19},"REF7707","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"domain","rsproxy[.]cn","Cargo registry path referencing a Chinese mirror\u002Fproxy service for crates.io",{"type":55,"value":59,"context":60},"d32tpl7xt7175h.cloudfront[.]net","JavaScript downloader referencing a CloudFront domain previously linked to China-affiliated actor UNC6384",[],{"controls":63,"vendors":147},[64,93,118],{"slug":65,"name":66,"problem":67,"products":68},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":52,"name":94,"problem":95,"products":96},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[97,105,110],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":106,"product_name":107,"url":108,"description":109},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":119,"name":120,"problem":121,"products":122},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":173},"antino-backdoor-abuses-microsoft-365-for-stealthy-c2-in-asia-espionage-campaign","Antino Backdoor Abuses Microsoft 365 for Stealthy C2 in Asia Espionage Campaign","The Antino backdoor, attributed to the China-nexus group UAT-11587, exploits legitimate Microsoft 365 services — Outlook and OneDrive — as command-and-control channels, allowing malicious traffic to blend seamlessly with trusted business communications. This technique is particularly dangerous because most organizations whitelist Microsoft services at the network perimeter, effectively neutralizing traditional C2 detection methods. The campaign targeting government and policy organizations highlights how nation-state actors increasingly 'live off the land' using trusted cloud infrastructure to evade detection. Without granular monitoring of API-level behavior and anomalous cloud service usage patterns, defenders have limited visibility into this class of threat. The use of Rust-compiled malware also increases resilience against reverse engineering and behavioral detection.",[159,160,161,162,163,164,165,166,167,168,169,170,171,172],"MITRE ATT&CK T1102 - Web Service (C2)","MITRE ATT&CK T1567 - Exfiltration Over Web Service","MITRE ATT&CK T1528 - Steal Application Access Token","CIS Control 3 - Data Protection","CIS Control 6 - Access Control Management","CIS Control 8 - Audit Log Management","CIS Control 12 - Network Infrastructure Management","NIST SP 800-53 AC-17 - Remote Access","NIST SP 800-53 SI-4 - System Monitoring","NIST SP 800-53 CA-7 - Continuous Monitoring","NIST SP 800-53 SC-7 - Boundary Protection","NIST CSF DE.CM-1 - Network Monitoring","ISO\u002FIEC 27001 A.12.4 - Logging and Monitoring","ISO\u002FIEC 27001 A.13.1 - Network Security Management",{}]