Talos Provisionally Links UAT-11587 to China as Group Repurposes Victims' Own Microsoft 365 Mailboxes as a C2 Channel
Cisco Talos is tracking a cluster of espionage activity it designates UAT-11587 — and, on a preliminary basis, attributing to China-linked actors. The group is using victims' own Microsoft 365 tenancies as a command-and-control channel, routing traffic through the email infrastructure defenders normally trust rather than hitting it as a target. Security Affairs, summarising the Talos research, reports that the campaign has been tracked since September 2025 and that, by July 2026, it had targeted at least 16 government and policy organisations across eight countries.
The campaign centres on a custom implant called the Antino backdoor, per the same summary. Rather than pointing back at attacker-controlled infrastructure — the pattern most detections are built around — UAT-11587 embeds its control channel inside the victim's own Microsoft 365 environment. For administrators, that means the adversary's traffic arrives from a legitimate tenancy, authenticated against legitimate identity services, and appears in audit logs alongside normal business activity.
How the abuse works
The mechanism is the story. Antino establishes persistence on a compromised host and uses Microsoft 365 services as a cover channel for tasking and data exfiltration, according to the Security Affairs summary. From a defender's vantage point, the traffic is difficult to separate from ordinary cloud use: authentication is real, mailbox access is legitimate, and the session tokens the backdoor relies on are issued by Microsoft itself. Detection teams that filter on destination reputation, IP blocklists, or known-malicious domains will see nothing anomalous — because from a network layer perspective, nothing is.
That makes this a category shift rather than a new signature. Cloud email is treated as the control plane of the modern enterprise, and here it has been turned into the adversary's control channel.
The China-linked attribution remains preliminary, per the Talos research as summarised by Security Affairs, and is subject to revision as evidence matures.
Analysis: what administrators should check now
The guidance in this section is HKLUG's own analysis, derived from the technical mechanism described in the Talos/Security Affairs reporting — it is not guidance issued by Talos.
M365 administrators should treat this as an audit exercise rather than a patch operation. Five areas are worth prioritising:
Mailbox rule and delegate review. Inbox rules that forward mail externally, delegate permissions granted to unfamiliar accounts, and unusual auto-reply configurations are classic signs of mailbox abuse. Sweep tenancies for these indicators, and correlate any finds against identity logs.
OAuth consent auditing. Consent grants let third-party applications access mailbox data without further user interaction. Review the full inventory of consented applications, remove anything unrecognised, and enforce administrative consent workflows for new grants.
Identity and sign-in monitoring. Look for sign-ins from unfamiliar locations, impossible-travel patterns, legacy authentication protocols, and tokens issued to unfamiliar apps. These are the signals that distinguish a legitimate user from an implant hijacking a legitimate session.
Defender telemetry coverage. Confirm that Microsoft 365 audit and Defender signals are flowing into the SIEM, not sitting idle in the tenant. Detection coverage depends on the data actually being correlated somewhere central.
Indicators of compromise. The Talos research on UAT-11587 and the Antino implant is expected to include indicators of compromise. Before ingesting any third-party IOC set into endpoint and network controls, validate them against your own environment — since the adversary's channel is shaped like ordinary cloud traffic, overly aggressive matching risks business disruption.
Analysis: why the framing matters
The observations in this section are HKLUG's own analysis, not statements attributed to Talos or Security Affairs.
For years, defenders have assumed the cloud is where attacks are blocked — the service provider's responsibility. UAT-11587 exploits exactly that assumption. When the command channel lives inside your own tenancy, the boundary between "our environment" and "attacker infrastructure" collapses, and detection responsibility shifts squarely back to the tenant administrator.
This also raises a practical question for incident-response planning: are purple-team exercises testing detection of malicious traffic hitting Microsoft 365, or traffic originating from it? Most tooling, by default, tests the former.
The lesson for defenders is straightforward: the campaign's greatest defence is that the traffic looks like your own services.
Sourcing note: The quantitative and attribution details reported above — the September 2025 tracking start, the July 2026 endpoint, the count of 16 organisations across eight countries, and the preliminary China-linked attribution — are drawn from Security Affairs' published summary of Cisco Talos's research. HKLUG has not independently verified these figures against the primary Talos advisory at the time of publication.
Talos 初步將 UAT-11587 歸因於中國：該組織將受害者自身的 Microsoft 365 信箱改裝為 C2 通道
Cisco Talos 正追蹤一個代號 UAT-11587 的間諜活動集群，並初步將其歸因於與中國關聯的行為者。該組織利用受害者的 Microsoft 365 租戶（tenancy）作為 command-and-control（C2）通道，將流量經由防禦人員通常會信任的電郵基建路由，而非將其作為攻擊目標。根據 Security Affairs 對 Talos 研究的摘要，該攻擊行動自 2025 年 9 月起持續受到追蹤，截至 2026 年 7 月已針對至少八個國家、共 16 個政府及政策機構。
根據同一則摘要，該攻擊行動的核心是一支名為 Antino backdoor 的自訂 implant。與大多數偵測系統所針對的模式不同——即流量回指向攻擊者控制的基建——UAT-11587 將其控制通道嵌入受害者自身的 Microsoft 365 環境之內。對系統管理員而言，這意味著敵方流量來自一個合法租戶、經合法身份服務（identity services）認證，並在審計日誌中與正常商業活動並列出現。
濫用手法如何運作
手法本身就是事件的重點。根據 Security Affairs 對 Talos 研究的摘要，Antino 會在遭入侵的主機上建立持久化（persistence），並利用 Microsoft 365 服務作為任務下達及數據外洩的掩護通道。從防禦者的角度看，該流量難以與一般雲端使用區分：認證是真實的，信箱存取是合法的，backdoor 所依賴的 session token 亦由 Microsoft 本身發出。依賴目標聲譽（destination reputation）、IP blocklist 或已知惡意域名進行過濾的偵測團隊將不會發現任何異常——因為從網絡層面而言，確實什麼都沒有異常。
這使事件屬於類別轉變，而非單純出現新的 signatures。電郵雲端服務已被視為現代企業的控制平面（control plane），而現今它已被轉化為敵方的控制通道。
根據 Security Affairs 的摘要，與中國關聯的歸因目前屬初步性質，並會隨證據成熟而作出修訂。
分析：系統管理員現階段應檢查的事項
本節指引為 HKLUG 的分析，乃根據 Talos／Security Affairs 報道中所述的技術手法整理而成，並非 Talos 發出的指引。
M365 系統管理員應將此視為一項 audit 演習，而非 patch 作業。以下五個範疇值得優先處理：
信箱規則及委派權限審查。 將電郵對外轉寄的 inbox rules、授予陌生帳戶的委派權限（delegate permissions），以及異常的自動回覆設定，都是信箱被濫用的典型跡象。應全面掃描租戶內的這些指標，並與身份日誌進行關聯分析。
OAuth consent 審計。 Consent grants 允許第三方應用程式在無需用戶進一步互動的情況下存取信箱資料。應檢視所有已授權應用程式清單，移除任何無法辨認的項目，並對新的 grants 強制實施管理層審批流程（administrative consent workflow）。
身份及登入監控。 留意來自陌生地點的登入、impossible-travel 模式、legacy authentication 協議，以及向陌生應用程式發出的 tokens。這些訊號正是區分合法用戶與「劫持合法 session 的 implant」的關鍵。
Defender 遙測覆蓋。 確認 Microsoft 365 audit 及 Defender 信號已流入 SIEM，而非閒置在租戶之內。偵測覆蓋率取決於數據是否真的在中央位置進行關聯分析。
Indicators of compromise。 Talos 關於 UAT-11587 及 Antino implant 的研究預料將包含 indicators of compromise（IoC）。在將任何第三方 IOC 納入端點及網絡管控措施之前，須先對照自身環境加以驗證——因為敵方通道形似普通雲端流量，過度激進的匹配規則有造成業務中斷的風險。
分析：為何這種框架值得關注
本節觀點為 HKLUG 的分析，並非歸因於 Talos 或 Security Affairs 的陳述。
多年來，防禦人員一直假設雲端是阻擋攻擊的地方——屬於服務供應商的責任範圍。UAT-11587 恰恰利用了這項假設。當 command channel 位於你自身的租戶之內，「我們的環境」與「攻擊者基建」之間的界線便會瓦解，偵測責任便明確地重新落回租戶系統管理員身上。
這亦對事件應變（incident-response）規劃提出一個實際問題：purple-team 演習測試的是偵測針對 Microsoft 365 的惡意流量，還是源自 Microsoft 365 的流量？大多數工具預設測試的是前者。
給防禦人員的教訓直接了當：此攻擊行動最難應付之處，在於流量看起來與你自身的服務無異。
資料來源說明： 上述報導的量化資料及歸因內容——包括 2025 年 9 月開始追蹤、2026 年 7 月的截點、八個國家共 16 個機構的數目，以及與中國關聯的初步歸因——均引自 Security Affairs 已刊出的 Cisco Talos 研究摘要。HKLUG 於發稿時並未獨立地與 Talos 原始公告核對上述數據。