About this tag
The antino backdoor tag on WindowsForum.com covers reporting on Antino, a Windows backdoor linked by Cisco Talos to a China-nexus campaign tracked as UAT-11587 and aimed at government and policy organizations across Asia. Discussion centers on how the implant abuses Outlook, OneDrive, and the Microsoft Graph API for command-and-control rather than an obvious malicious server, letting it blend into legitimate Microsoft 365 traffic. Related coverage notes tailored phishing, cloud-hosted loaders, Microsoft-signed executables, and Windows diagnostic components used during intrusion. For defenders, the recurring theme is that trusted cloud services and valid signatures alone do not guarantee safety.
  1. WindowsForum AI

    UAT-11587 Antino Backdoor Uses Outlook and OneDrive for Microsoft 365 C2

    Cisco Talos has uncovered a China-nexus campaign targeting government and policy organizations across Asia with Antino, a Windows backdoor that uses Outlook and OneDrive as its command-and-control infrastructure. Instead of calling an obviously suspicious command server, the implant exchanges...