Cybersecurity
Antino backdoor uses Outlook and OneDrive for control
Cisco Talos said a cluster it calls UAT-11587 deployed the Antino backdoor against government and policy organisations in Asia, using Microsoft 365 services for command and file transfer.
- Cisco Talos said it first detected the activity in September 2025, after spear-phishing against Taiwan's academic, think-tank and civil-society policy community.
- It said the campaign later reached 16 entities across eight Asian countries and also targeted organisations in Syria around May 2026.
- Talos said Antino was a Rust-built Windows backdoor that used Microsoft 365, Microsoft Graph, Outlook and OneDrive for command-and-control.
- Talos said it had not found a link between UAT-11587 and Jewelbug's financially motivated activity, so it treated UAT-11587 separately.
- It said Chinese-language metadata, UTC+08:00 headers, lure themes and build artefacts supported a high-confidence China-nexus assessment.
Cisco Talos said a cluster it tracks as UAT-11587 had been running phishing-led intrusions against government and policy bodies in several Asian countries. It said the activity first appeared in September 2025, when the targets were tied to Taiwan's academic, think-tank and civil-society policy community.
Talos said the campaign later extended to 16 entities across eight Asian countries, and evidence also pointed to organisations in Syria around May 2026. The firm said attack volume rose between March and early June 2026, with a concentrated burst on 8 and 9 June aimed at systems associated with government IT.
The researchers said the intrusion set deployed Antino, a Rust-built Windows backdoor that could inspect hosts, run commands, move files and maintain persistence. They said Microsoft 365 was used as the command channel, with Microsoft Graph mediating Outlook and OneDrive.
Talos said it could not connect UAT-11587 with Jewelbug's financially motivated activity, so it treated the cluster as separate. It nevertheless assessed the actor as China-nexus with high confidence, citing Chinese-language metadata, UTC+08:00 headers, lure topics and build artefacts linked to a Chinese code mirror.
Named in this story
People
- Ashley Shen
- the security researcher quoted on the malware
Companies
- Broadcom-owned Symantec
- co-authored an August 2026 report on Jewelbug
- Arctic Wolf
- identified a CloudFront domain in an earlier campaign
Organisations
- Cisco Talos
- tracked the cluster and published the analysis
- UAT-11587
- Talos's label for the intrusion set
- Jewelbug
- the cluster Talos compared against UAT-11587
- CL-STA-0049
- one of the China-aligned clusters cited for similarity
- Earth Alux
- one of the China-aligned clusters cited for similarity
- Ink Dragon
- one of the China-aligned clusters cited for similarity
- REF7707
- one of the China-aligned clusters cited for similarity
- UNC6384
- the China-affiliated actor Arctic Wolf linked to that campaign
Products and systems
- Antino
- the backdoor deployed in the campaign
- Microsoft 365
- the platform used for command traffic
- Microsoft Graph
- the API used to reach Outlook and OneDrive
- Outlook
- the mailbox service used for command exchange
- OneDrive
- the storage service used for heartbeat and file transfer
- Cloudflare Pages
- the hosting service used for the phishing link
- Gmail
- the mail interface the lure imitated
Places
- Taiwan
- the first target country named in the campaign
- Syria
- one of the countries later targeted
How the source tells it
The register was a restrained technical report, with the article presenting attribution and malware details without strong editorial colouring.
No emotive framing was found in the original.