Antino backdoor uses Outlook and OneDrive for C2 in China-nexus campaign

A China-nexus threat actor is targeting government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand and Myanmar. Cisco Talos uncovered a previously undocumented backdoor dubbed Antino that abuses Outlook and OneDrive for command-and-control.

• Targets include government and policy organizations in seven Asian countries
• The Antino backdoor was previously undocumented and linked to a China-nexus actor
• Attackers use Outlook and OneDrive for command-and-control
• Cisco Talos is tracking the activity cluster