Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

A China-nexus threat actor has been conducting an espionage campaign targeting government and policy organizations across multiple Asian countries including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. The campaign involves the deployment of a previously undocumented backdoor named Antino. The threat actor leverages Microsoft Outlook and OneDrive as command-and-control (C2) infrastructure, a technique that helps blend malicious traffic with legitimate cloud service communications. Cisco Talos is tracking this activity cluster. The use of trusted cloud services for C2 makes detection more challenging for defenders. The campaign is focused on intelligence gathering from government and policy-related targets, consistent with state-sponsored espionage objectives.