{"id":11234,"date":"2026-10-04T00:00:01","date_gmt":"2026-10-04T00:00:01","guid":{"rendered":"https:\/\/bitep.net\/blog\/2026\/10\/04\/antino-backdoor-c2-outlook-onedrive\/"},"modified":"2026-10-04T00:00:01","modified_gmt":"2026-10-04T00:00:01","slug":"antino-backdoor-c2-outlook-onedrive","status":"publish","type":"post","link":"https:\/\/bitep.net\/blog\/2026\/10\/04\/antino-backdoor-c2-outlook-onedrive\/","title":{"rendered":"Antino Backdoor: \u00c7in \u018flaq\u0259li Casusluq Kampaniyas\u0131nda C2 \u00fc\u00e7\u00fcn Outlook v\u0259 OneDrive-dan \u0130stifad\u0259 Edir"},"content":{"rendered":"<h2>Antino Backdoor: \u00c7in M\u0259n\u015f\u0259li Kiber Casusluq Kampaniyas\u0131nda Yeni Taktika<\/h2>\n<p>Kibert\u0259hl\u00fck\u0259sizlik t\u0259dqiqat\u00e7\u0131lar\u0131 \u00c7in m\u0259n\u015f\u0259li (China-nexus) d\u00f6vl\u0259t d\u0259st\u0259kli t\u0259hdid qruplar\u0131n\u0131n korporativ infrastrukturlara y\u00f6n\u0259lmi\u015f m\u00fcr\u0259kk\u0259b kibercasusluq \u0259m\u0259liyyat\u0131n\u0131 \u00fcz\u0259 \u00e7\u0131xar\u0131blar. Kampaniyan\u0131n m\u0259rk\u0259zind\u0259 dayanan <strong>Antino<\/strong> adl\u0131 z\u0259r\u0259rli proqram (backdoor), \u0259n\u0259n\u0259vi \u0259mr v\u0259 idar\u0259etm\u0259 (C2 &#8211; Command and Control) infrastrukturundan imtina ed\u0259r\u0259k Microsoft-un legitim bulud ekosistemind\u0259n \u2014 x\u00fcsusil\u0259 Microsoft Outlook v\u0259 OneDrive xidm\u0259tl\u0259rind\u0259n faydalan\u0131r. Bu yana\u015fma z\u0259r\u0259rli f\u0259aliyy\u0259tin qlobal korporativ \u015f\u0259b\u0259k\u0259 trafiki i\u00e7\u0259risind\u0259 tamamil\u0259 gizl\u0259nm\u0259sin\u0259 v\u0259 standart perimetr m\u00fcdafi\u0259 sisteml\u0259rinin yan ke\u00e7ilm\u0259sin\u0259 z\u0259min yarad\u0131r.<\/p>\n<h2>\u0130lkin Yoluxma Vektorlar\u0131 v\u0259 Kampaniyan\u0131n Yay\u0131lma Sxemi<\/h2>\n<p>Antino arxa qap\u0131s\u0131n\u0131n h\u0259d\u0259f \u015f\u0259b\u0259k\u0259l\u0259r\u0259 yeridilm\u0259si y\u00fcks\u0259k s\u0259viyy\u0259li h\u0259d\u0259fli h\u00fccum (spear-phishing) kampaniyalar\u0131 v\u0259 xaric\u0259 a\u00e7\u0131q korporativ t\u0259tbiql\u0259rd\u0259ki bo\u015fluqlar\u0131n istismar\u0131 il\u0259 ba\u015flay\u0131r. Analitikl\u0259rin \u0259ld\u0259 etdiyi telemetriya m\u0259lumatlar\u0131na \u0259sas\u0259n, h\u00fccum\u00e7ular a\u015fa\u011f\u0131dak\u0131 metodologiyadan istifad\u0259 edirl\u0259r:<\/p>\n<ul>\n<li><strong>H\u0259d\u0259fli Fi\u015finq (Spear-Phishing):<\/strong> T\u0259cav\u00fczkarlar korporativ personal\u0131n maraq dair\u0259l\u0259rin\u0259 uy\u011funla\u015fd\u0131r\u0131lm\u0131\u015f, z\u0259r\u0259rli makroslar v\u0259 ya LNK fayllar\u0131 ehtiva ed\u0259n arxivl\u0259rl\u0259 ilkin icran\u0131 t\u0259min edirl\u0259r.<\/li>\n<li><strong>Xarici \u015e\u0259b\u0259k\u0259 Cihazlar\u0131n\u0131n \u0130stismar\u0131:<\/strong> Korporativ perimetrd\u0259 yerl\u0259\u015f\u0259n k\u00f6hn\u0259lmi\u015f SSL-VPN \u015fl\u00fczl\u0259ri v\u0259 ya Microsoft Exchange serverl\u0259ri \u00fcz\u0259rind\u0259ki kritik z\u0259iflikl\u0259r (RCE) vasit\u0259sil\u0259 daxili \u015f\u0259b\u0259k\u0259y\u0259 s\u0131zma h\u0259yata ke\u00e7irilir.<\/li>\n<li><strong>DLL Side-Loading:<\/strong> Z\u0259r\u0259rverici ad\u0259t\u0259n legitim, r\u0259q\u0259msal imzal\u0131 binaril\u0259r vasit\u0259sil\u0259 yadda\u015fa (memory) y\u00fckl\u0259nir. Bu \u00fcsul Antino-nun fayl sistemind\u0259 a\u015fkarlanma riskini minimuma endirir.<\/li>\n<\/ul>\n<h2>C2 Arxitekturas\u0131: Outlook v\u0259 OneDrive-dan Nec\u0259 Sui-istifad\u0259 Edilir?<\/h2>\n<p>Antino-nu t\u0259hl\u00fck\u0259li ed\u0259n \u0259sas amil onun &#8220;Living-off-the-Cloud&#8221; (LotC) konsepsiyas\u0131na \u0259saslanan \u0259mr v\u0259 idar\u0259etm\u0259 mexanizmidir. H\u00fccum\u00e7ular x\u00fcsusi C2 domenl\u0259ri qeydiyyatdan ke\u00e7irm\u0259k v\u0259 ya \u015f\u00fcbh\u0259li IP \u00fcnvanlar\u0131 il\u0259 \u0259laq\u0259 saxlamaq \u0259v\u0259zin\u0259, Microsoft Graph API v\u0259 legitim bulud protokollar\u0131 vasit\u0259sil\u0259 rabit\u0259 qururlar.<\/p>\n<h3>1. Microsoft Outlook \u00dcz\u0259rind\u0259n \u018fmrl\u0259rin Al\u0131nmas\u0131<\/h3>\n<p>Z\u0259r\u0259rverici yoluxmu\u015f sistemd\u0259 \u00f6nc\u0259d\u0259n konfiqurasiya olunmu\u015f v\u0259 ya komprometasiya edilmi\u015f e-po\u00e7t hesablar\u0131na qo\u015fulur. \u018fmrl\u0259r adi e-po\u00e7t m\u0259ktublar\u0131, qaralamalar (Drafts) v\u0259 ya daxili qovluqlarda yerl\u0259\u015fdiril\u0259n x\u00fcsusi ba\u015fl\u0131ql\u0131 (Subject) mesajlar vasit\u0259sil\u0259 \u00e7atd\u0131r\u0131l\u0131r:<\/p>\n<ul>\n<li>Antino m\u00fc\u0259yy\u0259n edilmi\u015f intervallarla po\u00e7t qutusunu sor\u011fulay\u0131r (polling).<\/li>\n<li>T\u0259cav\u00fczkar\u0131n g\u00f6nd\u0259rdiyi e-po\u00e7tun g\u00f6vd\u0259sind\u0259 v\u0259 ya \u0259lav\u0259sind\u0259 \u015fifr\u0259l\u0259nmi\u015f (m\u0259s\u0259l\u0259n, AES v\u0259 ya Base64 il\u0259 kodla\u015fd\u0131r\u0131lm\u0131\u015f) icra \u0259mrl\u0259ri yer al\u0131r.<\/li>\n<li>\u018fmr icra edildikd\u0259n d\u0259rhal sonra Antino izl\u0259ri itirm\u0259k \u00fc\u00e7\u00fcn h\u0259min e-po\u00e7tlar\u0131 tamamil\u0259 silir v\u0259 ya po\u00e7tun t\u0259mizl\u0259nm\u0259si (purge) prosesini i\u015f\u0259 sal\u0131r.<\/li>\n<\/ul>\n<h3>2. OneDrive Vasit\u0259sil\u0259 M\u0259lumatlar\u0131n S\u0131zd\u0131r\u0131lmas\u0131 (Exfiltration)<\/h3>\n<p>H\u0259d\u0259f sistemd\u0259n toplanan h\u0259ssas s\u0259n\u0259dl\u0259r, konfiqurasiya fayllar\u0131 v\u0259 parollar \u015f\u0259b\u0259k\u0259d\u0259n k\u0259nara \u00e7\u0131xar\u0131lmazdan \u0259vv\u0259l \u015fifr\u0259l\u0259nir v\u0259 arxivl\u0259\u015fdirilir. Daha sonra Antino Microsoft OneDrive API-l\u0259rind\u0259n istifad\u0259 ed\u0259r\u0259k bu fayllar\u0131 h\u00fccum\u00e7ular\u0131n n\u0259zar\u0259tind\u0259ki saxlama anbar\u0131na y\u00fckl\u0259yir. T\u0259hl\u00fck\u0259sizlik \u018fm\u0259liyyatlar\u0131 M\u0259rk\u0259zl\u0259ri (SOC) \u00fc\u00e7\u00fcn bu trafik tamamil\u0259 legitim Microsoft domenl\u0259rin\u0259 (m\u0259s\u0259l\u0259n, <code>graph.microsoft.com<\/code>) y\u00f6n\u0259lmi\u015f HTTPS\/TLS trafiki kimi g\u00f6r\u00fcnd\u00fcy\u00fcnd\u0259n, \u0259n\u0259n\u0259vi IDS\/IPS sisteml\u0259ri t\u0259r\u0259find\u0259n he\u00e7 bir anomaliya qeyd\u0259 al\u0131nm\u0131r.<\/p>\n<h2>Antino Backdoor-un Texniki Bacar\u0131qlar\u0131<\/h2>\n<p>Analizl\u0259r g\u00f6st\u0259rir ki, Antino casusluq f\u0259aliyy\u0259tini tam \u015f\u0259kild\u0259 d\u0259st\u0259kl\u0259m\u0259k \u00fc\u00e7\u00fcn geni\u015f funksionall\u0131\u011fa malikdir:<\/p>\n<ul>\n<li><strong>Sistem K\u0259\u015ffiyyat\u0131:<\/strong> \u018fm\u0259liyyat sistemi parametrl\u0259rini, aktiv prosesl\u0259ri, domen m\u0259lumatlar\u0131n\u0131 v\u0259 lokal istifad\u0259\u00e7i imtiyazlar\u0131n\u0131 toplamaq.<\/li>\n<li><strong>Uzaqdan Kod \u0130cras\u0131:<\/strong> Sistemd\u0259 PowerShell v\u0259 ya Windows Command Shell (cmd.exe) vasit\u0259sil\u0259 ixtiyari \u0259mrl\u0259ri i\u015f\u0259 salmaq.<\/li>\n<li><strong>Fayl \u0130dar\u0259etm\u0259si:<\/strong> Cihaza \u0259lav\u0259 z\u0259r\u0259rli modullar y\u00fckl\u0259m\u0259k, fayllar\u0131 oxumaq, modifikasiya etm\u0259k v\u0259 ya silm\u0259k.<\/li>\n<li><strong>Qal\u0131c\u0131l\u0131q (Persistence):<\/strong> Qeydiyyat d\u0259ft\u0259ri (Registry Run keys) v\u0259 ya Windows Planla\u015fd\u0131r\u0131lm\u0131\u015f Tap\u015f\u0131r\u0131qlar\u0131 (Scheduled Tasks) vasit\u0259sil\u0259 sistem yenid\u0259n ba\u015flad\u0131ld\u0131qda avtomatik aktivl\u0259\u015fm\u0259.<\/li>\n<\/ul>\n<h2>A\u015fkarlama v\u0259 T\u0259hl\u00fck\u0259sizlik T\u00f6vsiy\u0259l\u0259ri<\/h2>\n<p>Legitim bulud xidm\u0259tl\u0259rini h\u0259d\u0259f alan bu c\u00fcr m\u00fcr\u0259kk\u0259b h\u00fccumlar\u0131n qar\u015f\u0131s\u0131n\u0131 almaq \u00fc\u00e7\u00fcn t\u0259\u015fkilatlar perimetr \u0259sasl\u0131 yana\u015fmadan davran\u0131\u015f \u0259sasl\u0131 (behavioral) identifikasiya modelin\u0259 ke\u00e7m\u0259lidirl\u0259r.<\/p>\n<h3>\u015e\u0259b\u0259k\u0259 v\u0259 Bulud Monitorinqi<\/h3>\n<ul>\n<li><strong>OAuth v\u0259 T\u0259tbiq \u0130caz\u0259l\u0259rin\u0259 N\u0259zar\u0259t:<\/strong> Microsoft Entra ID (Azure AD) m\u00fchitind\u0259 qeydiyyatdan ke\u00e7mi\u015f t\u0259tbiql\u0259ri m\u00fct\u0259madi audit edin. H\u0259ddind\u0259n art\u0131q geni\u015f icaz\u0259l\u0259r\u0259 (m\u0259s\u0259l\u0259n, <code>Mail.ReadWrite<\/code>, <code>Files.ReadWrite.All<\/code>) malik olan \u015f\u00fcbh\u0259li proqramlar\u0131 d\u0259rhal bloklay\u0131n.<\/li>\n<li><strong>API Z\u0259ngl\u0259rinin \u0130zl\u0259nm\u0259si:<\/strong> Standart i\u015f stansiyalar\u0131ndan (x\u00fcsusil\u0259 Outlook m\u00fc\u015ft\u0259risi qura\u015fd\u0131r\u0131lmam\u0131\u015f v\u0259 ya qeyri-adi binaril\u0259rd\u0259n) birba\u015fa Microsoft Graph API-y\u0259 edil\u0259n sor\u011fular\u0131 qeyd\u0259 al\u0131n v\u0259 t\u0259hlil edin.<\/li>\n<li><strong>\u015e\u0259b\u0259k\u0259 Telemetriyas\u0131:<\/strong> H\u0259cmli m\u0259lumatlar\u0131n OneDrive v\u0259 ox\u015far bulud anbarlar\u0131na \u00e7\u0131x\u0131\u015f\u0131n\u0131 m\u0259hdudla\u015fd\u0131ran DLP (Data Loss Prevention) h\u0259ll\u0259rind\u0259n istifad\u0259 edin.<\/li>\n<\/ul>\n<h3>U\u00e7 N\u00f6qt\u0259 (Endpoint) M\u00fcdafi\u0259si<\/h3>\n<ul>\n<li>Korporativ ma\u015f\u0131nlarda EDR\/XDR sisteml\u0259rinin real vaxt rejimind\u0259 skanlama funksiyas\u0131n\u0131 t\u0259min edin; DLL side-loading \u0259lam\u0259tl\u0259rini (m\u0259s\u0259l\u0259n, qeyri-adi qovluqlarda icra edil\u0259n legitim binaril\u0259ri) izl\u0259yin.<\/li>\n<li>PowerShell v\u0259 dig\u0259r skript m\u00fchitl\u0259rind\u0259 &#8220;Constrained Language Mode&#8221; t\u0259tbiq edin v\u0259 Script Block Logging funksionall\u0131\u011f\u0131n\u0131 aktivl\u0259\u015fdirin.<\/li>\n<li>B\u00fct\u00fcn inzibati v\u0259 istifad\u0259\u00e7i hesablar\u0131nda FIDO2 v\u0259 ya t\u0259tbiq \u0259sasl\u0131 \u00c7oxfaktorlu Autentifikasiyan\u0131 (MFA) m\u0259cburi edin.<\/li>\n<\/ul>\n<h3>N\u0259tic\u0259<\/h3>\n<p>Antino arxa qap\u0131s\u0131 \u00c7in m\u0259n\u015f\u0259li kiber casusluq aktorlar\u0131n\u0131n a\u015fkarlanmadan yay\u0131nma taktikalar\u0131n\u0131 inki\u015faf etdirdiyini n\u00fcmayi\u015f etdirir. Legitim infrastrukturun C2 kimi istifad\u0259si g\u00f6st\u0259rir ki, t\u0259\u015fkilatlar yaln\u0131z \u015f\u0259b\u0259k\u0259 k\u0259narlar\u0131n\u0131 deyil, daxili bulud qar\u015f\u0131l\u0131ql\u0131 \u0259laq\u0259l\u0259rini v\u0259 t\u0259tbiq icaz\u0259l\u0259rini d\u0259 s\u0131f\u0131r etimad (Zero Trust) prinsipi il\u0259 idar\u0259 etm\u0259lidirl\u0259r.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Antino Backdoor: \u00c7in M\u0259n\u015f\u0259li Kiber Casusluq Kampaniyas\u0131nda Yeni Taktika Kibert\u0259hl\u00fck\u0259sizlik t\u0259dqiqat\u00e7\u0131lar\u0131 \u00c7in m\u0259n\u015f\u0259li (China-nexus) d\u00f6vl\u0259t d\u0259st\u0259kli t\u0259hdid qruplar\u0131n\u0131n korporativ infrastrukturlara y\u00f6n\u0259lmi\u015f m\u00fcr\u0259kk\u0259b kibercasusluq \u0259m\u0259liyyat\u0131n\u0131 \u00fcz\u0259 \u00e7\u0131xar\u0131blar. Kampaniyan\u0131n m\u0259rk\u0259zind\u0259 dayanan Antino adl\u0131 z\u0259r\u0259rli proqram (backdoor), \u0259n\u0259n\u0259vi \u0259mr v\u0259 idar\u0259etm\u0259 (C2 &#8211; Command and Control) infrastrukturundan imtina ed\u0259r\u0259k Microsoft-un legitim bulud ekosistemind\u0259n \u2014 x\u00fcsusil\u0259 Microsoft Outlook v\u0259 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":11233,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-11234","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/bitep.net\/blog\/wp-content\/uploads\/2026\/10\/antino-backdoor-c2-1791071996096.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts\/11234","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/comments?post=11234"}],"version-history":[{"count":0,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/posts\/11234\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/media\/11233"}],"wp:attachment":[{"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/media?parent=11234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/categories?post=11234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitep.net\/blog\/wp-json\/wp\/v2\/tags?post=11234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}