Microsoft 365 (Outlook, OneDrive) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/microsoft-365-outlook-onedrive/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 30 Sep 2026 10:18:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgChina-nexus UAT-11587 Targets Asian Government Entities with Antino Backdoorhttps://feed.craftedsignal.io/briefs/2026-09-china-uat11587/Wed, 30 Sep 2026 10:18:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-china-uat11587/China-nexus threat actor UAT-11587 is conducting long-term cyber espionage across Asia using the custom Rust-based Antino backdoor and Microsoft 365 services for command-and-control.Since September 2025, the China-nexus threat actor UAT-11587 has engaged in sustained espionage targeting government, defense, and policy research organizations across Asia, including Taiwan, India, the Philippines, and Cambodia. The campaign is characterized by high-effort spear-phishing lures and a multi-stage infection chain that culminates in the deployment of "Antino," a custom, Rust-compiled Windows backdoor. Antino is notable for its use of legitimate Microsoft 365 services, specifically Outlook and OneDrive, as an obfuscated command-and-control (C2) channel, effectively bypassing traditional network-perimeter-based detection by masquerading as standard cloud traffic. With over 350 compromised endpoints identified across eight countries, the actor demonstrates significant operational capacity for long-term intelligence gathering, leveraging Cloudflare infrastructure for payload staging and execution tracking.

Attack Chain

  1. Initial Access: The actor sends spear-phishing emails containing tailored decoy documents or links to cloud-hosted malicious content.
  2. Execution: The target is lured into executing a malicious downloader or HTA file, often hosted on Cloudflare infrastructure, which initiates the infection sequence.
  3. Staging: The initial downloader fetches secondary-stage payloads from cloud-hosted staging environments.
  4. Payload Delivery: The custom Antino backdoor is dropped and executed on the victim host.
  5. Persistence: Antino establishes persistence mechanisms on the Windows endpoint to maintain access across reboots.
  6. Reconnaissance: The malware performs host reconnaissance, collecting system information and user data.
  7. C2 Communication: Antino communicates with Microsoft 365 (Outlook/OneDrive) to receive instructions and exfiltrate collected intelligence.
  8. Exfiltration: Data is uploaded to the actor-controlled OneDrive storage or sent via Outlook, completing the espionage cycle.

Impact

The campaign has resulted in the compromise of approximately 350 endpoints across national security, diplomatic, legislative, and civil society sectors. Successful attacks allow the adversary to conduct deep reconnaissance, maintain persistent access, and exfiltrate sensitive policy and diplomatic intelligence. Given the focus on high-value public-sector targets, the breach of these systems represents a significant threat to regional stability and national security for the affected nations.

Recommendation

  1. Monitor network traffic for unusual usage of Microsoft Graph APIs or excessive interaction with Microsoft 365 endpoints (Outlook/OneDrive) originating from servers or workstations that do not typically perform high volumes of office automation.
  2. Implement strict controls on the execution of HTA files (HTML Applications) and block macros in untrusted documents via Group Policy.
  3. Deploy EDR rules to monitor for Rust-compiled binaries executing from temporary directories or atypical user paths.
  4. Block connections to the identified CloudFront infrastructure domain d32tpl7xt7175h.cloudfront.net if detected in proxy or DNS logs.
  5. Conduct a hunt for the existence of unknown or unsigned Rust-compiled executables residing in common persistence locations like the Windows Startup folder or Run registry keys.
]]>highthreatespionagewindowscloud-native-c2rustspear-phishing