Plan
active
Antino Backdoor Abuses Outlook/OneDrive for C2 in Asia Espionage
- Engineer — Learn: No CVE or patch surface here, but the technique of tunneling C2 through legitimate Microsoft cloud services (Outlook/OneDrive APIs) is worth understanding when designing network egress controls and M365 API monitoring.
- SOC/IR — Plan: The Outlook/OneDrive C2 pattern is a detection-engineering opportunity — build or tune rules for anomalous Microsoft Graph API calls (unexpected mail-item access, atypical OneDrive polling patterns) that could surface this TTP in your estate this quarter.
- Leader — Learn: China-nexus espionage targeting government and policy organizations across Asia; relevant for sector threat-awareness briefings but no immediate action required unless your organization operates in the targeted geographies or policy verticals.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.