Antino malware uses Microsoft 365 to conduct cyber espionage

Cybersecurity researchers at Cisco Talos have identified a sophisticated espionage campaign conducted by a group designated as UAT-11587, which is believed to have high-confidence links to China. The group utilizes a previously undocumented Windows backdoor named Antino, written in the Rust programming language.

What distinguishes Antino is its command-and-control method. Rather than communicating with a traditional malicious server, the malware uses Microsoft Graph to interact with Microsoft 365 services. It receives instructions via Outlook mailboxes and exfiltrates stolen data through OneDrive, allowing its malicious traffic to blend in with legitimate organizational activity.

Since September 2025, the campaign has targeted approximately 350 computers across eight countries, including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. The victims include defense ministries, diplomatic missions, universities, and policy think tanks. The attackers reportedly used highly targeted phishing documents, such as fake workshop papers on information warfare, to gain initial access.