Cybersecurity specialists have revealed a new threat posed by a Python-based framework known as TWINLOOT. This sophisticated tool is designed to leverage Microsoft’s platforms such as SharePoint and Teams to infiltrate networks and steal credentials discreetly.
Technical Breakdown of TWINLOOT’s Operations
TWINLOOT utilizes a PyArmor-hardened Python implant that fully operates within trusted Microsoft services, according to Ontinue’s report. The command-and-control (C2) infrastructure is executed via SharePoint Online using the Graph API, while interactive sessions are routed through Teams’ TURN servers. Ontinue’s investigation highlights its covert operations, appearing as regular network activities by using the victim’s Edge browser to transmit tasks and data.
The implant’s capabilities include harvesting credentials via fake lock screens, establishing a reverse SOCKS5 tunnel for network access, executing commands, and maintaining persistence. Researchers identified these during a July 2026 campaign, noting the malware’s reliance on multiple C2 channels through familiar Microsoft services.
Entry Points and Persistence Tactics
Initial access typically stems from social engineering attacks via Teams, where malicious actors pose as IT support to deliver a PowerShell command. This command downloads necessary components, including the Python runtime and a large payload, to initialize TWINLOOT. The threat actors demonstrate adeptness in navigating Microsoft’s cloud infrastructure, making TWINLOOT a pioneering tool in combining 365 C2 tactics, Teams relay abuse, and browser transport.
The malware employs dual channels: a SharePoint dead-drop for command polling and a SOCKS5 tunnel for interactive access. These are designed to mimic legitimate processes, with the SOCKS5 tunnel enabling lateral movement within the network, disguised as routine connections from the victim’s machine.
Implications and Future Outlook
The discovery of TWINLOOT and similar threats like msaRAT underscores a growing trend of exploiting TURN relays for covert operations. Both TWINLOOT and msaRAT use headless browsers and remote debugging interfaces to drive interactions, albeit with different approaches. The persistence strategy of TWINLOOT, involving manipulation of Windows Registry and profile hives, marks a first in malicious software development.
While the identity of those behind TWINLOOT remains unclear, links to a group known as STAC4749 have been suggested. This group has a history of using Teams for phishing attacks and deploying ransomware, although TWINLOOT’s implementation differs significantly from previous tactics.
The emergence of such advanced threats necessitates vigilant cybersecurity measures, particularly as attackers continue to innovate and exploit trusted platforms. Organizations must enhance their defenses against social engineering and ensure robust monitoring of network activities to mitigate risks posed by tools like TWINLOOT.
