Security analysts have identified an emerging Python malware framework, dubbed TWINLOOT, which cleverly routes its command-and-control (C2) activities through trusted Microsoft services. This approach raises significant concerns, as many systems view Microsoft traffic as inherently safe, making detection more challenging.
The discovery stemmed from an investigation by the Ontinue Cyber Defense Center into an ongoing cyber campaign conducted in July. The researchers noted that TWINLOOT employs various Microsoft platforms, including SharePoint Online for file storage, the TURN infrastructure of Microsoft Teams for communications, and utilizes a headless instance of the victim’s Microsoft Edge browser to initiate requests through the Microsoft Graph API.
According to the report shared with CSO, TWINLOOT often terminates its C2 traffic within Microsoft’s IP range, avoiding the typical indicators associated with malicious activities. “TWINLOOT operates under the advantage that security teams typically don't suspect Microsoft traffic as malicious,” observed Shane Barney, Chief Information Security Officer at Keeper Security. Such traffic appears legitimate, leading many detection tools to overlook it entirely.
Inside the Trust Boundary
The structure of TWINLOOT distinctively separates routine commands from interactive access. For instance, its SharePoint channel checks for commands roughly every 15 seconds, returning results while exfiltrating stolen credentials and reconnaissance data back to its operators.
Notably, TWINLOOT authenticates with a malicious Azure tenant, meaning there are no authentication or audit events generated within the victim's Microsoft 365 environment. This lack of logged activity complicates the identification of malicious behavior significantly.
For interactive access, the malware can create a reverse SOCKS5 tunnel, taking advantage of Teams’ infrastructure. This allows attackers to manipulate internal network resources, making external connections appear as though they’re originating from the compromised machine itself.
Interestingly, TWINLOOT is only the second known case of a real-world attack leveraging Teams' TURN service and makes use of WebRTC DataChannels, marking a notable departure from traditional exploitation techniques.
The implant operates further below the radar by launching Microsoft Edge in headless mode. It connects through Chrome DevTools Protocol and executes Graph API calls that appear as standard "same-origin fetch ()" requests coming from the browser. This makes it challenging to differentiate its traffic from regular Edge communications, as indicated by network telemetry.
Commenting on the complexities introduced by TWINLOOT, Robert Coles, Senior Manager of Threat Intelligence Security at Black Duck, emphasized that attackers are increasingly hiding within recognized cloud services instead of relying on compromised infrastructure. He suggests focusing on behavioral indicators, such as monitoring identity alerts, unusual API activity, and strange user behavior within SharePoint and Teams.
Credential Theft and Persistence without Admin Rights
The TWINLOOT implant can be instructed to present a Windows lock screen filled with the victim’s actual account details. It captures every password attempt, without validating them upfront, ensuring that all entries are encrypted and routed back through the SharePoint C2 channel. In this façade, victims receive standard incorrect password notifications while authenticating their logins.
Once credentials are captured, attackers can utilize the reverse SOCKS tunnel to facilitate lateral movement within the network, potentially enabling unauthorized access via RDP, SMB, or WinRM protocols.
Further exacerbating detection challenges, TWINLOOT implements a persistence technique termed “Corrupting the Hive Mind.” This technique creates a Windows mandatory-profile hive offline, requiring no administrative rights and generating no registry change events.
According to Ontinue, this method represents the first known deployment of such a technique in the wild. Security professionals are urged to prioritize monitoring for unusual SharePoint, Teams, and Microsoft Graph activity instead of relying solely on conventional malware signatures. Recommendations also include disabling Edge's headless mode, monitoring for atypical Python activities, resetting compromised credentials, and adopting phishing-resistant authentication methods.
