Antino Rust Backdoor Leverages Microsoft Graph for Outlook-OneDrive C2 in UAT-11587 Campaign

Cisco Talos documented Antino's capabilities including host reconnaissance, in-memory shellcode execution, PowerShell invocation and persistence via scheduled tasks. Initial access relied on spear-phishing with spoofed trusted senders and lures tailored to Taiwanese legislative and maritime themes. The actor's use of rsproxy.cn Cargo paths and the d32tpl7xt7175h.cloudfront.net JavaScript downloader directly links to prior UNC6384 operations, establishing operational continuity rather than new tooling. Evidence shows zh-CN metadata and UTC+08:00 timestamps in phishing headers, while build artifacts reference mainland China proxy services. Talos explicitly decoupled UAT-11587 from Jewelbug's cryptocurrency operations despite Symantec's August 2026 reporting, highlighting attribution friction when espionage and profit motives intersect. The campaign's June 2026 spike against government IT infrastructure indicates pre-positioning for sustained access. Microsoft 365 C2 bypasses traditional network monitoring by blending with legitimate enterprise traffic, a pattern seen in multiple China-nexus clusters. This choice exposes organizations that fail to audit Graph API permissions or enforce conditional access. Expansion beyond Asia to Syrian targets suggests broadening collection priorities consistent with Beijing's diplomatic and security requirements. Defenders should monitor for anomalous Outlook and OneDrive API calls from endpoints lacking prior Graph authorization. Procurement records for endpoint detection tools that inspect Microsoft 365 telemetry will likely increase as similar actors adopt the same channel.