UAT-11587 Antino Backdoor Uses Outlook and OneDrive for Microsoft 365 C2

The activity, tracked as UAT-11587, combines carefully tailored phishing, cloud-hosted loaders, Microsoft-signed executables and Windows diagnostic components. For defenders, the uncomfortable lesson is that familiar infrastructure and valid signatures are not substitutes for understanding what a process is actually doing.

The campaign’s scale—and the limits of the evidence​

Talos’s investigation covers activity from September 2025 through July 2026. By July, researchers had identified approximately 350 compromised endpoints and at least 16 affected or targeted institutional environments. That institutional count needs careful handling: it comprises 10 confirmed affected environments, five probable affected environments and one additional intended target, not 16 confirmed organizational breaches.

Talos assesses with moderate-to-high confidence that the campaign targeted organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria. The sectors span defense, diplomacy, central government, legislatures, law enforcement, government IT, universities, think tanks and civil-society organizations.

The earliest reviewed operations used Philippines-themed lures and direct email attachments. January 2026 brought additional HTML application, or HTA, campaigns and a standalone fake-installer branch. Activity accelerated from March through early June; on June 8–9, researchers identified around 57 newly observed endpoints associated with India. These are historical observations, not a measurement of infections occurring today.

Phishing that borrows trust twice​

The Taiwan operations illustrate how the actor combined credible subject matter with convincing presentation. Recovered decoys covered information warfare, legislators’ tax treatment and an Indo-Pacific policy event. Other filenames referenced maritime affairs, diplomacy, human rights and government administration. Talos cautions that a lure’s apparent audience does not, by itself, establish delivery or compromise.

The emails also imitated Gmail’s attachment-preview interface. Four inline images recreated an attachment card, but clicking it followed an attacker-controlled Cloudflare Pages link rather than opening a genuine attachment. A recipient identifier in the link supported individualized tracking. Talos notes that protocol-relative links beginning with // may be missed by extraction tools that recognize only explicit HTTP or HTTPS prefixes.

Sender spoofing supplied another layer of credibility. In a reviewed message, SPF passed for the attacker-controlled envelope-sender domain, while the visible From address impersonated a trusted organization. DMARC failed because the identities were unaligned, but the impersonated domain’s p=none policy requested monitoring rather than quarantine or rejection, and the receiving service delivered the message. An SPF pass did not authenticate the sender the recipient saw.

Five stages from a document lure to Antino​

Talos documents a recurring five-stage infection chain, alongside alternative delivery branches:

1. Script execution: A downloaded HTA runs through mshta.exe, sends an execution-tracking request and retrieves JavaScript. Parallel WSF stagers use Windows Script Host.
2. Decryption: JScript downloads an encrypted orchestrator and two serialized.NET resources, then decodes and decrypts them.
3. In-memory loading: A.NET BinaryFormatter deserialization chain loads and executes TestAssembly.dll inside the script-host process.
4. Decoy and payload staging: The downloader opens a lure document and writes a DLL-sideloading bundle.
5. Signed-host execution: A legitimate Microsoft-signed GatherOsState.exe loads the adjacent malicious slc.dll, starting Antino.

Cloudflare Pages supplied delivery and tracking, Cloudflare R2 stored loader and payload components, and Amazon CloudFront delivered additional content. Separate software-themed domains also distributed standalone Antino fake installers. The cloud-heavy chain should not be confused with the implant’s native C2 channel, which operates through Microsoft 365.

Why the.NET distinction matters​

Microsoft’s security guidance states that BinaryFormatter is unsafe for untrusted input and cannot be made secure through configuration alone. Microsoft also documents that the built-in implementation throws on use starting with.NET 9.

That is not evidence that installing a newer.NET runtime stops this campaign. Talos describes a.NET 4.x loading chain. The practical distinction is between changing an application’s serialization design and assuming a modern runtime installation disables the legacy components malware uses. Those are different problems.

Outlook commands, OneDrive transfers​

Antino appears in 32-bit and 64-bit Windows builds, in both executable and DLL forms. Its capabilities include host reconnaissance, command-shell and PowerShell execution, directory enumeration, file transfer, in-memory shellcode loading and Registry Run-value persistence. Availability varies by generation and build.

In the reviewed second-generation design, Antino authenticates using OAuth client credentials, without an interactive user sign-in. It uses the attacker’s Microsoft 365 resources as asynchronous exchange points:

The upload/download naming follows the operator’s perspective. Outlook message subjects use command_req_[session_id] and command_res_[session_id] to associate tasking and results with an implant session.

Microsoft 365 being used for C2 does not establish that the victim’s Microsoft 365 tenant was compromised. Talos describes attacker-controlled OneDrive and mailbox resources. Consequently, searching only the victim organization’s cloud logs is not a complete investigation strategy; endpoint process and network evidence remains essential. That is a defensive inference from the reported architecture.

Where Windows defenders can act​

Interrupt script execution—with a deployment caveat​

Microsoft documents a concrete control relevant to the HTA branch: App Control for Business blocks MSHTA code execution when a policy with script enforcement is active—even when that policy is in audit mode. Windows Script Host scripts must also be allowed by the applicable policies or they are blocked.

That makes application control a useful prevention layer, but also a compatibility trap. Administrators should pilot policies against required workflows rather than assume audit mode cannot disrupt legacy HTA applications. This control addresses an observed delivery route; it does not prove that every Antino branch will be prevented.

Hunt for relationships, not isolated filenames​

Talos’s findings support several retrospective investigation leads:

• mshta.exe or Windows Script Host activity associated with downloaded HTA/WSF lures and campaign infrastructure.
• GatherOsState.exe executing from an unexpected writable directory alongside slc.dll.
• Files staged under %LOCALAPPDATA%\Windows GatherOSStateKit\, correlated with HKCU Run-value changes.
• Unusual sdiagnhost.exe activity associated with diagnostic temporary directories, PowerShell scripts and persistence changes.

Antino abuses the Windows Scripted Diagnostics workflow to proxy attacker-controlled PowerShell through legitimate components. Talos emphasizes that this complicates attribution but does not erase file-creation, PowerShell or registry telemetry. The investigative goal is therefore correlation—not treating every diagnostic host or similarly named DLL as malicious.

Use Entra logs where the organization has visibility​

Microsoft’s service-principal sign-in logs record non-user application authentication, including certificate-based Microsoft Graph access and client-secret authentication through the OAuth client-credentials flow. Relevant entries can help investigate unfamiliar applications and unexpected resource access in a tenant administrators control.

However, those logs should not be expected to expose all authentication occurring in an attacker-controlled tenant. The appropriate conclusion is narrower: examine app-only activity where visibility exists, and correlate it with endpoint evidence rather than interpreting an empty local search as clearance.

Attribution without overreach​

Talos assigns high confidence to its China-nexus assessment, drawing on preparation metadata, targeting and development artifacts. Examples include Simplified Chinese metadata and repeated references to a China-focused Rust package mirror. Neither UTC+8 timestamps nor use of a publicly accessible mirror independently establishes an operator’s location. Talos rates the intelligence-gathering assessment at moderate confidence.

The researchers also distinguish UAT-11587 from related reporting. Possible delivery-infrastructure overlap with UNC6384 is assessed with low confidence. Although Talos identifies overlap with Symantec’s Jewelbug research, it could not independently verify the connection to Jewelbug’s financially motivated activity and retains a separate tracking designation.

The central defensive takeaway is straightforward: trusted services can carry hostile instructions, and signed programs can load hostile code. Antino makes both points in one campaign. Effective investigation follows the chain from email and script execution to DLL loading, persistence and cloud communication—not merely the reputation of the final destination.