China‑Nexus Espionage Campaign Uses Outlook/OneDrive Backdoor

A newly identified threat actor from China has launched an espionage operation that leverages Microsoft Exchange Online mailbox rules and OneDrive uploads to establish covert command-and-control pathways against government and policy organizations across Asia ¹. The attack, codenamed Antino, is being tracked by Cisco Talos as a cluster of malicious activity.

The campaign specifically focuses on agencies in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, deploying a previously undocumented backdoor that blends seamlessly with routine business traffic. By embedding malicious payloads into image files uploaded via SharePoint online storage, attackers can trigger PowerShell scripts delivered through OneDrive links without raising typical outbound traffic alerts. This technique mirrors older tactics such as macro payloads used in Operation Aurora but benefits from using native office protocols like `ms-outlook:` or `ms-word:` which automatically launch applications upon clicking links.

According to Cisco Talos, the backdoor’s design allows it to remain undetected during off‑hours after initial reconnaissance, thereby avoiding network intrusion alerts that usually spike unexpectedly due scheduled maintenance windows. The use of dynamic process injection further obfuscates malware behavior, rendering static analysis ineffective and making traditional signature-based blocking insufficient.

From a privacy perspective, the Antino campaign poses significant risks for sensitive governmental data. Because the channel uses legitimate Microsoft services, standard security monitoring tools may not flag suspicious activity unless they focus explicitly on outbound connections associated with these protocols. Moreover, the covert nature of the command channels means compromised accounts could exfiltrate information under the guise of normal business operations, potentially bypassing conventional detection mechanisms.

The exploitation chain begins when an attacker gains access—often through phishing or credential theft—to a user account with sufficient privileges within Exchange Online. Once inside, mailbox rules are configured to forward emails containing hidden instructions to malicious endpoints hosted on OneDrive. When recipients open attachments, embedded image files trigger PowerShell scripts that establish persistent footholds while remaining disguised as ordinary Office documents.

Organizations using Microsoft’s suite should therefore review their mailbox rule configurations, enforce strict least-privilege policies for users accessing Exchange Online, and monitor for anomalous link patterns involving `ms-outlook:` or `ms-word:` handlers. Additionally, implementing endpoint protection that can detect dynamic process injection will help mitigate the risk posed by this backdoor.

In summary, Antino represents a sophisticated espionage tool that exploits trusted infrastructure to create stealthy C2 channels, enabling adversaries to infiltrate government networks across multiple Asian countries without triggering traditional security alerts. Vigilance around legitimate Microsoft services is now more critical than ever.