New Python Implant Framework TWINLOOT Exploits Microsoft Services for Stealthy C2 Operations Cybersecurity researchers at Ontinue have uncovered TWINLOOT, a previously undocumented Python-based implant framework designed to conceal its command-and-control (C2) infrastructure within trusted Microsoft services. The malware, discovered during an investigation into an ongoing campaign in July 2026, leverages SharePoint Online, Microsoft Teams TURN servers, and the Microsoft Graph API to evade detection while maintaining persistent access to compromised systems. ### Key Features & Attack Chain TWINLOOT operates through two parallel C2 channels, both exploiting legitimate Microsoft services: 1. SharePoint Dead Drop C2 - Authenticates to an attacker-controlled Azure tenant and polls a SharePoint drive for commands every 15 seconds. - Uses a headless instance of the victim’s Edge browser to ferry Graph API traffic, blending malicious activity with normal network behavior. - Enables data exfiltration, arbitrary command execution, and credential harvesting via pixel-perfect fake lock screens. 2. Reverse SOCKS5 Tunnel for Interactive Access - Establishes a SOCKS5 proxy over WebRTC DataChannels, relayed through Microsoft Teams TURN servers or a direct TLS/WebSocket connection. - Allows threat actors to pivot laterally within victim networks, mimicking legitimate traffic from the compromised host to internal services (e.g., SMB, RDP, WinRM, MSSQL). ### Initial Access & Persistence The attack begins with a social engineering lure via Microsoft Teams, where the threat actor posing as IT support tricks victims into executing a PowerShell command that downloads a 39 MB compiled Python payload ("bootstrap-fat.pyc"). This loader deploys TWINLOOT, which employs four persistence mechanisms, including: - TypeLib COM scriptlet hijacking - GhostTask-style TaskCache manipulation - Self-updating via a reob.json manifest - A novel Registry-based method using Swarmer, an open-source tool that creates stealthy HKCU Registry keys without admin privileges by generating a mandatory profile hive (NTUSER.MAN) marking the first known malicious use of this technique in the wild. ### Credential Theft & Lateral Movement TWINLOOT captures Windows credentials through fake lock screen prompts triggered by the "credz_waiting" command. The entered password regardless of validity is encrypted and exfiltrated to the attacker’s SharePoint drive, then abused via the SOCKS5 tunnel for RDP or WinRM-based lateral movement. ### Evasion & Development The implant is PyArmor-hardened to resist analysis and can fall back to an EtherHiding-style mechanism (though unused in the current build) if Azure Blob Storage dead drops fail. Its modular design suggests active development, with researchers noting operational overlaps with STAC4749, a threat cluster linked to Teams voice phishing campaigns and Chaos ransomware deployments. However, TWINLOOT’s implementation differs significantly, indicating either a rebuilt toolset or a separate actor adopting similar tactics. ### Broader Trend: TURN Relay Abuse TWINLOOT joins a growing list of malware exploiting TURN (Traversal Using Relays around NAT) relays for C2 communications, a technique first publicly detailed as "Ghost Calls" in 2025. Other recent examples include: - Backdoor.Turn (June 2026): A Go-based RAT used by DragonForce ransomware, leveraging Teams TURN relays via QUIC sessions. - msaRAT (August 2026): A Rust-based RAT attributed to the Chaos ransomware group, which abuses Twilio TURN relays and Chrome DevTools Protocol (CDP) to control a headless browser for C2. Both TWINLOOT and msaRAT independently adopted headless browser-based C2 within the same month, highlighting a convergence in offensive tradecraft among disparate threat actors. The reliance on Microsoft and cloud services for C2 infrastructure underscores the challenges of detecting malicious activity within trusted enterprise environments.