On 30 September 2026 Cisco Talos published research on a China-nexus actor it tracks as UAT-11587 and on a previously undocumented Windows backdoor called Antino. The notable feature is the command channel: Antino has no dedicated server. It talks only to Microsoft 365.
What Talos reports
- Activity was first spotted in a spear phishing campaign aimed at Taiwan's policy community, with earlier activity dating to September 2025.
- As of July 2026 Talos had identified at least 10 confirmed and five probable affected institutional environments, plus one more intended target, and about 350 compromised endpoints.
- Countries: Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria.
- Antino's command and control "operates exclusively through Microsoft 365," using the Microsoft Graph API. It polls an Outlook folder every 10 seconds. Command and response emails use subjects starting with command_req_ and command_res_ plus a session ID. OneDrive holds heartbeats, pulled data and pushed tools.
- A second generation authenticates with the OAuth 2.0 client credentials flow, so no interactive sign in is needed.
What is confirmed, reported and unknown
- Confirmed by Talos, with stated confidence: China-nexus attribution is "high confidence." Victimology is moderate to high. The intelligence gathering purpose is moderate. A link to UNC6384 delivery infrastructure is low confidence.
- Reported by others: a trade press account says the actor spoofed sender identities to get past SPF and DMARC. We did not verify that detail against the Talos text.
- Unknown: Talos could not verify a connection to Jewelbug's financially motivated activity and tracks UAT-11587 separately. The total number of victims is not known, and the figures above are as of July 2026.
Attribution here comes from technical artifacts such as decoy metadata and build paths, which can be forged. That is why the confidence levels matter more than the label.
How to check if you're exposed
Talos publishes indicators in its GitHub repository. The behaviors worth hunting yourself:
- Non browser processes that call graph.microsoft.com and login.microsoftonline.com.
- Mailbox items with subjects beginning command_req_ or command_res_.
- OneDrive folders named antino, antino_downloads or antino_uploads.
- Unexpected OAuth client credentials grants from endpoints that have no business with Graph.
What to do now
- Search Microsoft 365 audit logs for the mailbox subjects and OneDrive paths above.
- Review app registrations and service principals for unknown ones, and check their credentials.
- Block or alert on HTA and WSF execution that starts from email.
- Deploy the Talos ClamAV and Snort signatures if you use those tools.
- Keep PowerShell and file creation logging on. Talos notes the techniques do not remove that telemetry.
How this could have been avoided
- Tighter Graph egress. Few endpoints should call Microsoft Graph with app credentials. Alerting on the exceptions would expose a channel built on a trusted domain.
- Restrict script hosts. HTA, WSF and JScript launched from mail attachments are rarely needed.
- Phishing resistant email controls. Enforce DMARC on your own domain and teach staff to treat attachment previews inside an email body as untrusted.
- App registration governance. An approval process for new OAuth clients limits what the implant can use.
- Domain reputation filtering. The campaign used Cloudflare Pages and similar hosting, so link filtering should treat new project subdomains as unverified.
Try it yourself
Pick one workstation and list every process that has talked to graph.microsoft.com in the last week. Anything that is not Office or your management agent needs an explanation.
Click through it at your own pace, or open it full screen.
Quick check
How sure is Talos about the China link?
High confidence for China-nexus, based on combined artifacts. Overlap with UNC6384 infrastructure is low confidence.
Why is a Microsoft 365 command channel hard to block?
It uses a domain most organizations must allow. Detection depends on which process makes the calls and what the mailbox and OneDrive contain.
