Cisco Talos Identifies Antino Backdoor Leveraging Outlook and OneDrive in China-Nexus Espionage Campaign

Cisco Talos researchers have identified a new cyberespionage campaign attributed to a China-nexus threat actor. The operation involves the deployment of a previously undocumented backdoor codenamed Antino. The backdoor specifically targets government and policy organizations across Asia. The activity has been observed targeting victims in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar.

A distinguishing feature of the Antino backdoor is its use of legitimate Microsoft services for command and control (C2) communication. By leveraging Microsoft Outlook and OneDrive, the malware can blend in with normal user traffic, making it more difficult for security tools to distinguish between legitimate and malicious activity.

The campaign primarily targets government and policy organizations. The use of well-known Microsoft products for C2 suggests the threat actor is attempting to evade detection by exploiting trusted services. Cisco Talos is tracking the cluster and has attributed the activity to a China-nexus threat actor, though such attribution should be treated as reported and may require further corroboration.

As of the report publication, no specific software vulnerabilities have been identified as the initial entry point. The focus of the campaign appears to be on the deployment and operation of the backdoor rather than exploitation of a specific CVE. Microsoft has not released a specific patch addressing Antino, but general recommendations include keeping Microsoft products updated and monitoring for indicators of compromise associated with the backdoor.