Security researchers are raising alarms over a newly identified threat called TWINLOOT, a Python-based malware framework that has found a clever way to hide in plain sight. Instead of relying on traditional command-and-control (C2) servers controlled by attackers, this malware routes its communications through Microsoft services that defenders are conditioned to trust.
The Ontinue Cyber Defense Center discovered the implant while investigating an active campaign in July. Since then, researchers have tracked its behavior and detailed how it leverages SharePoint Online, Microsoft Teams, and even the victim’s own Microsoft Edge browser to maintain control and exfiltrate data.
How TWINLOOT Uses Microsoft Services as a Control Center
The core innovation of TWINLOOT lies in its ability to blend in with normal organizational traffic. According to the report shared with CSO, the malware’s primary C2 traffic terminates in Microsoft IP space rather than on domains owned by the attackers. This means the network traffic looks exactly like legitimate business activity, causing most detection tools to overlook it.
“TWINLOOT works because defenders have been trained to treat Microsoft traffic as safe by default, and this malware was built to take full advantage of that,” said Shane Barney, chief information security officer at Keeper Security. “There is no attacker-owned domain in the chain, which means the traffic looks exactly like what it is supposed to look like, and most detection tools will leave it alone.”
The malware separates its operations into two distinct channels:
- SharePoint Online as a Dead Drop: The implant polls a SharePoint drive roughly every 15 seconds to retrieve commands. It uses this same channel to return results and exfiltrate stolen credentials and reconnaissance data.
- Microsoft Teams for Interactive Access: For more dynamic interactions, TWINLOOT establishes a reverse SOCKS5 tunnel through Microsoft’s Teams TURN infrastructure. This allows operators to use the compromised endpoint to access internal network services like SMB, RDP, and WinRM.
Stealing Credentials and Persisting Silently
Beyond communication, TWINLOOT employs sophisticated methods for credential theft and persistence. On command, the malware can display a Windows 10 or Windows 11 lock screen populated with the victim’s real account information. It never validates the password; instead, every attempt is captured, encrypted, and sent to the SharePoint C2 channel. The victim sees a normal-looking incorrect password message before eventually authenticating successfully.
The stolen credentials can then be used for lateral movement through the reverse SOCKS tunnel, potentially granting access to other systems within the network.
The implant also features a persistence technique that Ontinue calls “Corrupting the Hive Mind.” This method creates a Windows “NTUSER.MAN” mandatory-profile hive offline. Crucially, it requires no administrator privileges and generates no registry modification event, making it extremely difficult to detect through traditional monitoring.
What This Means for You
For IT administrators and security professionals, TWINLOOT represents a significant shift in threat behavior. The reliance on trusted cloud services means that signature-based detection is no longer sufficient. Defense strategies must evolve to focus on behavioral analysis and identity monitoring.
Experts recommend focusing on anomalous activity in SharePoint, Teams, and Microsoft Graph. This includes monitoring for unusual Graph API activity, unexpected OAuth applications and consent grants, and irregular behavior in SharePoint and Teams. Additionally, disabling Edge headless mode, monitoring for unusual Python activity, and implementing phishing-resistant authentication are critical steps to mitigate risk.
The Broader Implications
TWINLOOT is only the second observed case of in-the-wild Teams TURN abuse, and Ontinue notes it is the first to use actual WebRTC DataChannels for this technique. This highlights a growing trend where attackers are increasingly hiding inside trusted cloud services rather than using attacker-controlled infrastructure.
Robert Coles, senior manager of threat intelligence security at Black Duck, commented on the detection complications TWINLOOT adds: “Attackers are increasingly hiding inside trusted cloud services rather than using attacker-controlled infrastructure.” He emphasized the need for defenders to adapt their monitoring capabilities to identify these sophisticated threats.
As organizations continue to rely heavily on Microsoft 365 and Azure, the line between legitimate traffic and malicious activity becomes increasingly blurred. TWINLOOT serves as a stark reminder that trust in infrastructure must be balanced with vigilant, behavior-based security monitoring.
Source: Computerworld
Over to you: How are you adjusting your monitoring strategies to detect malware that hides inside trusted cloud services like Microsoft 365?
