Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

What it is

Antino is a Rust-compiled Windows backdoor used by China-nexus cluster UAT-11587 (overlapping with Jewelbug but assessed by Cisco Talos as a distinct activity set), active since at least September 2025 and expanded to 16 entities across eight Asian countries plus Syria.

How it works

The attack is a five-stage chain: a phishing email contains a fake Gmail attachment-preview card (four inline Base64 PNGs wrapped in an anchor tag) pointing to a Cloudflare Pages URL, which delivers an HTA or WSF stager. That stager retrieves a JavaScript downloader/decryptor, which triggers a .NET deserialization chain loading "TestAssembly.dll." This component downloads/opens the lure document, drops a decoy Calculator executable, and downloads/launches Antino ("slc.dll") via DLL sideloading through the signed Microsoft binary GatherOsState.exe. Once running, Antino polls the actor's Outlook mailbox every 10 seconds for messages prefixed "command_req_[session_id]" to fetch commands, and uses OneDrive objects for heartbeat and file transfer — eliminating the need for a dedicated C2 server. For execution, it abuses the Windows Scripted Diagnostics framework to run attacker-controlled PowerShell through legitimate Windows components, which complicates (but does not eliminate) behavioral attribution.

flowchart TD
    A[Spoofed phishing email<br/>fake Gmail attachment card] --> B[Cloudflare Pages URL]
    B --> C[HTA/WSF stager]
    C --> D[JS downloader/decryptor]
    D --> E[.NET deserialization:<br/>TestAssembly.dll]
    E --> F[Lure doc shown to victim]
    E --> G[Decoy Calculator.exe]
    E --> H[Antino slc.dll<br/>sideloaded via GatherOsState.exe]
    H --> I[Outlook mailbox:<br/>command polling every 10s]
    H --> J[OneDrive:<br/>heartbeat + file transfer]

Preconditions / Affected

Targets are government, policy, academic, and civil-society organizations with Microsoft 365 mailboxes reachable by Outlook/OneDrive-based C2; the technique depends on the victim environment actively using Microsoft 365. Attack volume spiked March–early June 2026, with a concentrated wave on June 8–9, 2026 hitting dozens of government IT systems.

What to do

The page gives no remediation commands, but two concrete detection leads are stated: (1) look for outbound/API traffic to Microsoft Graph interacting with Outlook mailbox folders for messages subject-prefixed "command_req_[session_id]" at ~10-second intervals; (2) flag DLL sideloading via GatherOsState.exe and the dropped file "slc.dll." Network/infrastructure indicators include Cargo registry paths referencing rsproxy[.]cn in Antino build artifacts, and the JS downloader referencing CloudFront domain d32tpl7xt7175h.cloudfront[.]net (previously tied to UNC6384 activity against European diplomatic targets). Also watch for SPF/DMARC-spoofed sender addresses and Gmail HTML bodies containing a reconstructed attachment-preview widget (four inline Base64 PNG MIME parts wrapped in an anchor tag).

Caveats

Talos explicitly could not confirm a link between UAT-11587 and Jewelbug's financially motivated cryptocurrency-fraud activity, despite tactical overlap — the two are tracked separately. PowerShell execution via Scripted Diagnostics complicates but does not eliminate PowerShell, file-creation, or registry telemetry, per Talos.