Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365

Hackers have built a Windows backdoor that uses Microsoft 365 for all its native command and control communications. Named Antino, the malware turns Outlook messages and OneDrive files into channels for issuing instructions, moving stolen data, and maintaining access to compromised computers.

The wider campaign began in September 2025 and targeted government, defense, diplomatic, academic, and policy organizations.

Attackers used carefully tailored phishing emails, convincing documents, and fake software installers to deliver the backdoor, combining familiar interfaces with cloud services that organizations routinely trust.

Researchers from Cisco Talos identified the operation as UAT-11587 and assessed its links to China with high confidence.

Cisco Talos said in a report reviewed by Cyber Security News (CSN) that its investigation uncovered approximately 350 compromised endpoints across eight countries by July 2026.

Talos recorded 10 confirmed and five probable affected institutional environments, plus one intended target. Countries included Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria.

The findings reflect the broader risks of attacks bypassing email defenses through familiar platforms, although Talos assessed this campaign as intelligence gathering rather than financially motivated activity.

Hackers Built a Windows Backdoor

Antino is written in Rust and comes in both executable and library forms. Its native control channel uses Microsoft Graph, the interface applications use to access Microsoft services.

Outlook carries commands and responses, while OneDrive handles registration, status updates, stolen files, and tools delivered by the attackers.

This approach follows earlier cases of hackers abusing cloud services for covert communication, but Antino places its entire native control workflow inside Microsoft 365. The cloud infrastructure used to deliver the malware is separate from the services that control it after installation.

The newer generation authenticates through an Entra ID application using stored application credentials, without requiring an interactive user login.

It checks an attacker-controlled Outlook mailbox every 10 seconds, retrieves instructions from message bodies, and posts responses that let operators match results to individual tasks.

OneDrive receives a status file every minute containing the computer name, username, platform, session identifier, and campaign code.

Separate folders hold stolen victim files and incoming tools. These exchanges let the operator control infected machines without exposing a dedicated command server to network monitoring.

The backdoor can inspect systems, run shell and PowerShell commands, transfer files, execute programs, and load additional code directly into memory.

An optional concealment feature encrypts a loaded secondary payload while it sleeps, reducing its exposure to memory scanners without hiding the entire Antino process or guaranteeing evasion.

Phishing Opens a Layered Infection

The phishing emails impersonated trusted organizations and recreated Gmail’s attachment preview card. Clicking the apparent attachment instead opened an attacker-controlled download link.

Policy events, legislative taxation, maritime disputes, and government administration supplied relevant themes that made the messages more persuasive to their intended recipients.

In one reviewed message, sender authentication passed for the attacker’s sending domain, but the visible sender did not match. DMARC detected the mismatch, yet a monitoring-only policy allowed delivery.

This distinction matters because a successful sender check did not authenticate the organization recipients thought had contacted them.

A recurring five-stage chain used Windows scripting components, encrypted JavaScript, and unsafe .NET object processing to load a downloader in memory.

The downloader opened a decoy document and launched a signed Microsoft executable beside the malicious library, using DLL sideloading attack techniques to start Antino under a trusted host.

Talos based its attribution on several clues, including document language settings, development artifacts, and the campaign’s targeting. It also found overlaps with activity reported as Jewelbug, but could not independently confirm links to that group’s financial operations.

Shared delivery infrastructure suggested another possible connection, although researchers rated that relationship with low confidence and kept separate tracking.

Antino also abused Windows troubleshooting components to execute PowerShell and establish startup persistence. Talos noted that this disguises the execution path but still leaves observable script activity, file creation, and registry changes.

Its report supplies detection signatures and network rules, giving defenders concrete coverage alongside the source-verified indicators below.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC