Cisco Talos details Antino backdoor used by China-nexus actor against Taiwan government orgs

Cisco Talos has documented Antino, a previously undocumented Windows backdoor used by a suspected China-nexus actor. The targets are government and policy organizations across Asia, with Taiwan, India, and the Philippines named in the reporting. The story is carried by The Hacker News from Talos's research, with secondary writeups from other outlets following within a day.

The tradecraft is what makes this worth attention. Antino runs its command channel through Microsoft Graph, parking commands and exfiltrated data inside Outlook mail and OneDrive files. To a network monitor that traffic is indistinguishable from ordinary Microsoft 365 activity, and it rides tenant credentials that are already trusted, so IP blocklists and perimeter detection see nothing. At least one writeup couples the backdoor with DMARC spoofing, which means the delivery phishing can pass sender authentication checks as well.

The public record so far has no CVEs, no named victim organizations, and no confirmed intrusion counts, so treat the reporting scope as what Talos published, not a complete victim map. Watch for Talos IOC and detection guidance, additional APAC governments acknowledging incidents, and whether Microsoft restricts the abused Graph patterns. Defenders should log and baseline Graph API data-plane activity, particularly mailbox and OneDrive writes that no user workflow explains, instead of treating all Microsoft cloud traffic as benign by default.