A new espionage campaign, attributed to a China-nexus threat actor, has been observed targeting government and policy organizations across Asia. The campaign leverages a previously undocumented backdoor, dubbed Antino, which notably utilizes Microsoft Outlook and OneDrive for command-and-control (C2) communications. Cisco Talos is currently tracking this cluster of activity.
The Antino backdoor's use of legitimate cloud services like Outlook and OneDrive for C2 is a significant aspect of its operation. This technique, often referred to as "living off the land," allows threat actors to blend their malicious traffic with legitimate network activity, making detection more challenging for security teams. By using established and trusted platforms, the backdoor can evade traditional network perimeter defenses that might flag connections to known malicious infrastructure.
The mechanism likely involves the backdoor communicating with attacker-controlled accounts on Outlook and OneDrive. For Outlook, this could manifest as sending and receiving specially crafted emails, potentially using draft folders or hidden items to store commands and exfiltrated data. For OneDrive, the backdoor might interact with specific folders or files, using them as dead drops for instructions or to upload stolen information. This method provides a resilient and readily available C2 channel that is difficult to block without impacting legitimate organizational productivity.
The campaign has specifically targeted government and policy organizations across a broad geographical range in Asia. Countries identified as targets include Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. This wide scope suggests a strategic interest in geopolitical intelligence and policy-related information across the region.
Organizations in these sectors and regions should prioritize enhanced monitoring of their Microsoft 365 environments, particularly focusing on unusual activity originating from user accounts. This includes scrutinizing API calls to Outlook and OneDrive, monitoring for unusual file access patterns, and reviewing email rules or forwarding configurations. Implementing multi-factor authentication (MFA) across all accounts, enforcing strong password policies, and regularly auditing permissions for cloud services are standard mitigations that can help reduce the risk of account compromise.
The emergence of the Antino backdoor and its sophisticated C2 techniques underscores a continuing trend among advanced persistent threat (APT) groups to adopt stealthier methods. The reliance on legitimate cloud infrastructure for C2 communications represents an evolution in evasion tactics, forcing organizations to shift their defensive strategies from purely network-centric monitoring to more comprehensive cloud security posture management and insider threat detection. This campaign highlights the persistent and evolving threat of state-sponsored espionage in the digital domain.
