TWINLOOT Routes C2 Through Microsoft 365 and Azure, Polling SharePoint Every 15 Seconds
Updated
Updated · Computerworld · Aug 18
TWINLOOT Routes C2 Through Microsoft 365 and Azure, Polling SharePoint Every 15 Seconds
1 articles · Updated · Computerworld · Aug 18
Summary
Ontinue said the newly uncovered Python malware TWINLOOT hides command-and-control inside Microsoft services, with primary traffic terminating in Microsoft IP space instead of attacker-owned domains.
SharePoint Online serves as a dead drop polled about every 15 seconds, while the implant authenticates to an attacker-controlled Azure tenant—leaving no authentication or audit events in the victim’s Entra ID logs.
Teams TURN infrastructure carries interactive access through a reverse SOCKS5 tunnel, and a headless Edge browser sends Graph API requests that appear as legitimate same-origin Microsoft traffic.
TWINLOOT also steals passwords by showing a fake Windows 10 or 11 lock screen, then persists without admin rights via an NTUSER.MAN mandatory-profile hive technique that Ontinue said is a first in the wild.
Researchers urged defenders to watch for anomalous SharePoint, Teams and Graph activity, unusual Python and Edge headless use, and to reset exposed credentials and deploy phishing-resistant authentication.