New Antino Malware Leverages Microsoft Cloud Services for Covert Communications in Asian Espionage Operations

A previously unknown backdoor named Antino has been deployed in a targeted campaign against government and policy organizations across multiple Asian nations including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. The malware exploits Outlook and OneDrive as command-and-control communication channels, enabling sophisticated evasion of traditional network monitoring. Cisco Talos researchers are tracking the activity and attribute it to a threat actor with connections to China.

The discovery of Antino represents a notable development in state-sponsored cyber operations targeting the Asia-Pacific region. By weaponizing legitimate cloud services rather than relying on traditional infrastructure, the threat actors behind this campaign have developed a method to blend malicious communications within normal business traffic, complicating detection efforts for security teams relying on conventional network analysis tools.

This approach highlights an evolving challenge in cybersecurity: the dual-use nature of mainstream enterprise platforms. As organizations increasingly depend on cloud services for legitimate operations, distinguishing between benign and malicious activity becomes considerably more difficult, particularly when adversaries demonstrate sophistication in operational security practices.