Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel

Cisco Talos documents a China-linked espionage campaign (UAT-11587) using a Rust backdoor named Antino that exclusively uses Microsoft 365 (Microsoft Graph interacting with Outlook and OneDrive) as its command-and-control channel; the campaign employed targeted phishing, sophisticated multi-stage loaders and signed binary sideloading to compromise at least 16 government and policy organizations across eight Asian countries and exfiltrate data while blending with normal cloud/HTTPS traffic.