Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365

This report enumerates extensive IOCs and technical artifacts for an Antino-focused campaign: numerous SHA-256 hashes for HTA/WSF stagers, JScript orchestrators, encrypted BinaryFormatter resources, and Antino Gen1/Gen2 backdoor binaries; hosting and delivery infrastructure across Cloudflare Pages, CloudFront, and R2 domains; phishing/spear-phishing lures and standalone fake installers (flashcenter_pp_ax_install_en.exe); sideloading abuse of legitimate signed binaries (GatherOsState.exe) and diagnostics components; cloud heartbeat/upload paths and messaging subjects used for command/response; and development/build artifacts and GUIDs useful for detection and attribution.