UAT-11587 ‘Antino’ Backdoor: China-Nexus APT Weaponises Microsoft 365 to Spy on Indian Government Networks

When threat actors want to steal government secrets, the most effective strategy is not to break down the door — it is to use the key that is already hanging in the lock. China-nexus group UAT-11587 has taken that philosophy to a new extreme: their custom implant, dubbed Antino by Cisco Talos researchers, routes every stolen byte and every operator command through Microsoft Outlook and OneDrive via the Microsoft Graph API. The traffic looks identical to the cloud-sync activity running on millions of legitimate desktops right now — including, Talos warns, inside Indian government, defence, and policy organisations.

Cisco Talos published its full investigation on 30 September 2026. By the time of publication, at least 350 endpoints across eight Asian countries were already compromised. India recorded approximately 57 newly identified infected endpoints in a single June 2026 wave. For every IT leader who has assumed that Microsoft 365 is “safe” traffic, that number should be a wake-up call.

Who Is UAT-11587 — and Why Should India Care?

Cisco Talos first detected UAT-11587 activity in September 2025, during a spear-phishing operation targeting Taiwan’s academic and civil-society communities. Over the following ten months, the cluster evolved into a high-tempo espionage programme touching eight countries. Talos’s September 30 report — the most comprehensive public analysis to date — documented at least 10 confirmed compromised institutional environments, five more probable victims, and one additional intended target that appears to have been identified but not yet fully penetrated.

The actor is assessed as China-nexus based on targeting patterns (which map closely to China’s documented intelligence-collection priorities in Asia), overlaps with known Chinese APT tooling, and development artefacts embedded in the Antino malware binary itself.

The sectors targeted speak for themselves:

• Central government ministries and e-government service providers
• Defence and national-security institutions
• Legislatures and parliamentary staff
• Law-enforcement agencies
• Foreign-affairs bodies
• Universities, think tanks, and civil-society policy organisations

India’s prominence in the victim list is not accidental. The June 2026 spike — approximately 57 endpoints confirmed in days — correlates with a period of heightened geopolitical activity across South Asia and aligns with China’s documented interest in collecting intelligence on Indian government decision-making, defence procurement, and foreign-policy positions. If your organisation touches any of these sectors, you are a plausible target.

Technical Breakdown: The Five-Stage Infection Chain

UAT-11587’s infection chain is deliberately engineered to blend in. Every stage either abuses a legitimate platform or uses a trusted system binary, minimising the attack surface visible to traditional defences.

Stage	Component	Technique
1	HTA or WSF stager	Delivered via spear-phishing email; executes through mshta.exe or Windows Script Host
2	JScript downloader	Fetches an RC4-encrypted payload from Cloudflare R2 or Amazon CloudFront — both trusted CDN destinations
3	Encrypted .NET assembly	Decrypted with RC4; loaded and executed via unsafe BinaryFormatter deserialization and gadget chains in standard .NET assemblies
4	DLL sideload loader	Drops legitimate Microsoft-signed GatherOsState.exe alongside malicious slc.dll; the DLL is loaded automatically when the executable launches
5	Antino backdoor	Rust-compiled Windows implant; all C2 traffic routed through Microsoft Graph API using Outlook drafts and OneDrive as dead-drop channels

The most operationally dangerous element is Stage 5. Once Antino is resident, it communicates exclusively through Microsoft’s own cloud. The operator sends commands by writing to an Outlook draft or a OneDrive file; the implant reads them and writes responses back to the same location. From a network monitoring perspective, this traffic is completely indistinguishable from normal Microsoft 365 synchronisation — it terminates at Microsoft’s own CDN edge over standard HTTPS port 443.

Antino’s capabilities once deployed include: system and user enumeration, arbitrary shell-command execution, file upload and download, timestomping, scheduled-task and registry-run-key persistence, and in-memory shellcode execution. It is, in other words, a full-featured implant that can be used for long-term intelligence collection, lateral movement, and even pre-positioning for future destructive operations.

For a deeper look at how Chinese APT groups are exploiting enterprise collaboration platforms as initial access vectors — a trend that extends well beyond UAT-11587 — see our earlier analysis of the Warlock ransomware group’s abuse of Microsoft SharePoint in attacks on Indian critical infrastructure.

Why Traditional Defences Miss This Attack

The Antino campaign illustrates a fundamental gap in how many Indian organisations have architected their security stack. The conventional model — firewall on the perimeter, AV on the endpoint, no inspection of internal traffic to “trusted” destinations — is precisely what UAT-11587 has designed around:

• Perimeter firewalls: The C2 channel is HTTPS to Microsoft’s cloud. Every firewall that allows Microsoft 365 traffic will let Antino through untouched.
• Signature-based AV: Rust-compiled binaries are less familiar to signature engines. The DLL sideload technique abuses a legitimate, Microsoft-signed binary, so the “carrier” process looks clean.
• Email gateways: The initial phishing lure may carry a malicious attachment or a link to a convincing external page — both of which can slip past content-inspection controls if the lure is sufficiently targeted.
• SIEM without identity telemetry: If your SIEM ingests only network flow and endpoint event data, Graph API token abuse will be invisible. You need Entra ID sign-in and audit logs, not just Windows Security Event Logs.

This is precisely why zero-trust network architecture — which assumes any device or user may already be compromised and enforces least-privilege access dynamically — is the appropriate foundation for defending against threat actors of this sophistication.

What You Should Do Now — Sanjay Seth’s Defence Checklist

As a cybersecurity practitioner with three decades of experience protecting Indian enterprise and government networks, here is my immediate action list for any organisation that could be in UAT-11587’s target profile:

• 1. Audit Microsoft Graph API OAuth app registrations immediately. Log into Entra ID admin centre → Enterprise Applications → All Applications. Filter for apps with Mail.ReadWrite, Mail.Send, Files.ReadWrite, or Files.ReadWrite.All permissions. Any app you did not explicitly onboard deserves immediate investigation and revocation.
• 2. Restrict or block mshta.exe. HTA files have virtually no legitimate use in modern enterprise environments. Block mshta.exe via AppLocker, Windows Defender Application Control (WDAC), or your endpoint-hardening policy (FortiClient EMS can enforce application control centrally). This eliminates Stage 1 of the entire infection chain.
• 3. Apply SSL inspection to Cloudflare and CloudFront egress. A forward proxy with full SSL inspection — FortiProxy, Zscaler, or equivalent — can inspect the encrypted payload retrieval in Stage 2. Generic CDN storage buckets accessed from workstations should trigger a policy review.
• 4. Hunt DLL sideloading patterns in your EDR. Alert on GatherOsState.exe loading non-Microsoft DLLs. Extend this to any Microsoft-signed binary spawning unexpected child processes or loading unsigned DLLs from user-writeable directories (Desktop, AppData, Temp).
• 5. Search your SIEM and proxy logs for known IOCs right now:
  • DNS queries or HTTP connections to rsproxy[.]cn
  • Connections to d32tpl7xt7175h[.]cloudfront[.]net
  • Non-browser clients making Microsoft Graph API calls from workstation IP ranges
• 6. Enable Entra ID Protection and configure Conditional Access for Graph API. Restrict Graph API access to compliant, managed devices only. Enable Risky User and Risky Sign-in policies. Review the Entra ID audit log for any Add OAuth2PermissionGrant or Consent to Application events in the last 90 days.
• 7. Conduct a phishing-resilience review. UAT-11587’s initial access is spear-phishing. Organisations without a defined anti-phishing playbook — including simulation exercises, reporting workflows, and clear escalation procedures — are disproportionately vulnerable to Stage 1.

Frequently Asked Questions

Is Antino only a threat to government organisations?

Not at all. While UAT-11587 has focused on government, defence, and policy targets to date, the techniques it employs — spear-phishing, DLL sideloading, and Graph API dead-drop C2 — are fully transferable to corporate espionage. Any organisation handling commercially sensitive data, intellectual property, or legally privileged communications should treat this campaign as directly relevant.

Will my existing antivirus protect me from Antino?

Probably not reliably. Rust-compiled binaries look unfamiliar to signature-based AV engines. DLL sideloading abuses a legitimate, Microsoft-signed executable — so the “bad” process shows a clean parent. And Graph API traffic over HTTPS to Microsoft’s CDN is routinely whitelisted by even well-configured firewalls. Effective detection requires behavioural EDR, UEBA, and identity-layer monitoring via Entra ID audit logs.

My organisation uses Microsoft Defender for Endpoint — does it catch this?

Microsoft Defender can detect some stages of the UAT-11587 chain — particularly unusual mshta.exe activity and some DLL sideloading patterns — but no single control is sufficient. Microsoft’s own guidance on Graph API abuse recommends layering Conditional Access, strict app registration hygiene, and Entra ID Protection sign-in risk policies on top of endpoint controls. Defence-in-depth is non-negotiable for a threat actor of this calibre.

What should I do if I find Antino IOCs in my environment?

Isolate the affected endpoint immediately — do not simply remove the malware and move on. Antino establishes persistence and the operator may have spent weeks harvesting credentials, mapping your network, or planting additional implants. Revoke all tokens and credentials associated with the compromised identity. Engage a qualified incident-response team for a full compromise assessment. You can reach Sanjay Seth’s team at sanjayseth.com/contact for immediate IR guidance.

The Bottom Line

UAT-11587 and the Antino backdoor represent the current leading edge of nation-state cyber espionage: a patient, sophisticated, cloud-native operation that is virtually invisible to organisations still relying on perimeter-centric security models. India is not a peripheral target in this campaign — it is one of the most heavily hit countries in the dataset.

The good news is that the techniques UAT-11587 uses — however clever — have known countermeasures. Auditing Graph API token issuance, blocking mshta.exe, applying SSL inspection to CDN egress, and deploying a threat-hunting-capable SOC can all be achieved with the tooling most enterprise organisations already have. The question is not whether those controls are possible. It is whether they are in place today.

---

Ready to find out if your Microsoft 365 environment has already been compromised — or to build the zero-trust architecture that stops the next UAT-11587? Sanjay Seth and the P J Networks team provide zero-trust architecture reviews, Microsoft 365 security assessments, and 24×7 managed SOC services tailored to Indian enterprises and regulatory requirements.

→ Book a confidential security assessment today.