New Python Implant Framework TWINLOOT Exploits Microsoft Services for Stealthy C2 Operations
Cybersecurity researchers at Ontinue have uncovered TWINLOOT, a previously undocumented Python-based implant framework designed to conceal its command-and-control (C2) infrastructure within trusted Microsoft services. The malware, discovered during an investigation into an ongoing campaign in July 2026, leverages SharePoint Online, Microsoft Teams TURN servers, and the Microsoft Graph API to evade detection while maintaining persistent access to compromised systems.
Key Features & Attack Chain
TWINLOOT operates through two parallel C2 channels, both exploiting legitimate Microsoft services:
-
SharePoint Dead Drop C2
- Authenticates to an attacker-controlled Azure tenant and polls a SharePoint drive for commands every 15 seconds.
- Uses a headless instance of the victim’s Edge browser to ferry Graph API traffic, blending malicious activity with normal network behavior.
- Enables data exfiltration, arbitrary command execution, and credential harvesting via pixel-perfect fake lock screens.
-
Reverse SOCKS5 Tunnel for Interactive Access
- Establishes a SOCKS5 proxy over WebRTC DataChannels, relayed through Microsoft Teams TURN servers or a direct TLS/WebSocket connection.
- Allows threat actors to pivot laterally within victim networks, mimicking legitimate traffic from the compromised host to internal services (e.g., SMB, RDP, WinRM, MSSQL).
Initial Access & Persistence
The attack begins with a social engineering lure via Microsoft Teams, where the threat actor posing as IT support tricks victims into executing a PowerShell command that downloads a 39 MB compiled Python payload ("bootstrap-fat.pyc"). This loader deploys TWINLOOT, which employs four persistence mechanisms, including:
- TypeLib COM scriptlet hijacking
- GhostTask-style TaskCache manipulation
- Self-updating via a reob.json manifest
- A novel Registry-based method using Swarmer, an open-source tool that creates stealthy HKCU Registry keys without admin privileges by generating a mandatory profile hive (NTUSER.MAN) marking the first known malicious use of this technique in the wild.
Credential Theft & Lateral Movement
TWINLOOT captures Windows credentials through fake lock screen prompts triggered by the "credz_waiting" command. The entered password regardless of validity is encrypted and exfiltrated to the attacker’s SharePoint drive, then abused via the SOCKS5 tunnel for RDP or WinRM-based lateral movement.
Evasion & Development
The implant is PyArmor-hardened to resist analysis and can fall back to an EtherHiding-style mechanism (though unused in the current build) if Azure Blob Storage dead drops fail. Its modular design suggests active development, with researchers noting operational overlaps with STAC4749, a threat cluster linked to Teams voice phishing campaigns and Chaos ransomware deployments. However, TWINLOOT’s implementation differs significantly, indicating either a rebuilt toolset or a separate actor adopting similar tactics.
Broader Trend: TURN Relay Abuse
TWINLOOT joins a growing list of malware exploiting TURN (Traversal Using Relays around NAT) relays for C2 communications, a technique first publicly detailed as "Ghost Calls" in 2025. Other recent examples include:
- Backdoor.Turn (June 2026): A Go-based RAT used by DragonForce ransomware, leveraging Teams TURN relays via QUIC sessions.
- msaRAT (August 2026): A Rust-based RAT attributed to the Chaos ransomware group, which abuses Twilio TURN relays and Chrome DevTools Protocol (CDP) to control a headless browser for C2.
Both TWINLOOT and msaRAT independently adopted headless browser-based C2 within the same month, highlighting a convergence in offensive tradecraft among disparate threat actors. The reliance on Microsoft and cloud services for C2 infrastructure underscores the challenges of detecting malicious activity within trusted enterprise environments.
Source: https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html
Ontinue cybersecurity rating report: https://www.rankiteo.com/company/ontinue
"id": "ONT1787063426",
"linkid": "ontinue",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"{'affected_entities': [{'type': 'Enterprise'}],
'attack_vector': ['Social Engineering (Microsoft Teams)',
'PowerShell Execution'],
'data_breach': {'data_encryption': True,
'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Credentials', 'System Data']},
'date_detected': '2026-07-01',
'date_publicly_disclosed': '2026-07-01',
'description': 'Cybersecurity researchers at Ontinue uncovered TWINLOOT, a '
'previously undocumented Python-based implant framework '
'designed to conceal its command-and-control (C2) '
'infrastructure within trusted Microsoft services. The malware '
'leverages SharePoint Online, Microsoft Teams TURN servers, '
'and the Microsoft Graph API to evade detection while '
'maintaining persistent access to compromised systems.',
'impact': {'data_compromised': ['Credentials', 'Sensitive System Data'],
'identity_theft_risk': 'High',
'operational_impact': ['Lateral Movement via RDP/WinRM',
'Persistent Backdoor Access'],
'systems_affected': ['Windows Systems']},
'initial_access_broker': {'backdoors_established': ['SOCKS5 Proxy',
'SharePoint Dead Drop C2'],
'entry_point': 'Microsoft Teams Social Engineering'},
'investigation_status': 'Ongoing',
'lessons_learned': 'The incident highlights the growing trend of threat '
'actors abusing trusted cloud services (e.g., Microsoft '
'Graph API, SharePoint, Teams TURN servers) for C2 '
'operations, making detection challenging. The use of '
'headless browsers and novel persistence techniques (e.g., '
'Swarmer Registry keys) underscores the need for enhanced '
'monitoring of legitimate service interactions.',
'motivation': ['Data Exfiltration',
'Credential Harvesting',
'Lateral Movement',
'Persistent Access'],
'post_incident_analysis': {'corrective_actions': ['Enhance detection for '
'Graph API/SharePoint '
'abuse.',
'Block or monitor headless '
'browser interactions with '
'external services.',
'Implement stricter Teams '
'message policies.'],
'root_causes': ['Exploitation of trusted Microsoft '
'services for C2 evasion.',
'Use of social engineering to '
'trick victims into executing '
'malicious PowerShell.',
'Novel persistence techniques '
'(e.g., Swarmer Registry keys) '
'bypassing traditional '
'detection.']},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Implement strict Microsoft Teams message filtering to '
'block suspicious PowerShell execution requests.',
'Monitor and restrict access to Microsoft Graph API and '
'SharePoint Online for unusual activity.',
'Deploy behavioral detection for headless browser '
'processes (e.g., Edge) interacting with external '
'services.',
'Harden Windows systems against Registry-based '
'persistence techniques (e.g., Swarmer).',
'Conduct regular threat hunting for TURN relay abuse and '
'WebRTC DataChannel traffic.',
'Educate employees on social engineering tactics, '
'particularly via Microsoft Teams.'],
'references': [{'date_accessed': '2026-07-01',
'source': 'Ontinue Cybersecurity Research'}],
'response': {'third_party_assistance': 'Ontinue (Cybersecurity Researchers)'},
'threat_actor': 'STAC4749 (suspected)',
'title': 'TWINLOOT Python Implant Framework Exploits Microsoft Services for '
'Stealthy C2 Operations',
'type': 'Malware Implant Framework',
'vulnerability_exploited': ['Microsoft Graph API',
'SharePoint Online',
'Microsoft Teams TURN Servers']}