Cisco Talos UAT-11587 (30 Sep): Antino Rust backdoor — entire native C2 via Microsoft 365 Graph (Outlook/OneDrive)
Cisco Talos (30 September 2026; Cyber Security News amplify 1 Oct) tracks China-nexus UAT-11587 (high confidence) delivering previously undocumented Rust backdoor Antino against government and policy organisations across Asia (Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, Syria; ~350 endpoints / ≥16 institutional environments by July 2026; activity Sep 2025–Jul 2026). Five-stage chain: spear-phish (Migadu SPF-pass / DMARC p=none spoof; Gmail attachment widget clone on Cloudflare Pages) → HTA/WSF → JScript RC4 decrypt → .NET BinaryFormatter gadget → TestAssembly.dll → GatherOsState.exe sideload of slc.dll (Antino). Native C2 exclusively via Microsoft Graph: Outlook drafts/messages for command_req_/command_res_ tasking (~10s poll); OneDrive /antino/heartbeats/, antino_uploads/, antino_downloads/ for beacon/exfil/tooling; OAuth client-credentials. Capabilities: cmd/PowerShell, file transfer, in-memory shellcode with sleep-mask, Scripted Diagnostics (sdiagnhost) persistence via HKCU Run. Overlaps noted with Symantec Jewelbug but tracked separately. Primary: Talos; ClamAV/Snort coverage listed.
- Product
- Antino (Rust Windows backdoor; UAT-11587); Microsoft 365 Graph abused for C2
- Versions
- n/a (espionage malware; no Microsoft product CVE). Sample delivery: osc-cdn[.]com, microsoft-flash[.]com, wps-cn[.]com, *.pages.dev HTA hosts; Antino Gen2 slc.dll SHA-256 09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff; Graph to graph.microsoft.com / login.microsoftonline.com
- Exploited in Australia?
- unknown
- Patch to
- Enforce DMARC reject/quarantine (p=none enabled spoof delivery). Hunt mshta/wscript → Cloudflare R2/Pages; GatherOsState.exe loading unexpected slc.dll; Graph API from non-interactive apps with Mail.Read / Files.ReadWrite; OneDrive paths /antino/heartbeats/; HKCU Run via sdiagnhost. Apply Talos ClamAV/Snort IDs and GitHub IoCs. Review Entra app registrations using client-credentials to mailboxes.
Primary: Cisco Talos — UAT-11587 / Antino Microsoft 365 C2 (30 Sep 2026) · Vendor: Cisco Talos (primary) · Cryptika — Antino Windows backdoor M365 C2 (1 Oct 2026 amplify)