A new China-nexus threat actor, designated as UAT-11587, has been observed targeting government, policy, and academic organizations across Asia and Syria. The campaign utilizes a sophisticated multi-stage infection chain that begins with spear-phishing emails featuring a deceptive Gmail attachment preview widget. This social engineering tactic leads to the deployment of the Antino backdoor, a previously undocumented Rust-compiled malware designed for espionage and long-term persistence.
The Antino backdoor stands out for its stealthy command-and-control (C2) infrastructure, which exclusively leverages Microsoft 365 services. By utilizing the Microsoft Graph API to interact with Outlook and OneDrive, the malware masks its malicious traffic as legitimate cloud service activity. Beyond reconnaissance and file exfiltration, the implant abuses the Windows Scripted Diagnostics framework to execute PowerShell scripts, complicating attribution and detection by security software.
Top comments (0)