Full Report
Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file
Analysis Summary
# Tool/Technique: TWINLOOT
## Overview
TWINLOOT is a modular, Python-based implant framework discovered in mid-2026. It is distinguished by its sophisticated use of trusted Microsoft services—specifically SharePoint Online and Microsoft Teams—to host its command-and-control (C2) infrastructure. By leveraging the Microsoft Graph API through a headless Edge browser and utilizing Teams TURN servers for relaying traffic, the malware effectively masks its activities as legitimate enterprise network traffic.
## Technical Details
- **Type:** Python Implant Framework / Modular Malware
- **Platform:** Windows (specifically leverages Microsoft 365, Edge, and Teams environments)
- **Capabilities:** Modular tasking, credential harvesting (fake lock screens), reverse SOCKS5 pivoting, lateral movement, and persistence.
- **First Seen:** July 2026 (Reported August 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.003 - Phishing: Spearphishing via Service] (Abuse of Microsoft Teams for social engineering)
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell] (Initial downloader)
- **[TA0011 - Command and Control]**
- [T1102.002 - Web Service: Bidirectional Communication] (SharePoint Online via Graph API)
- [T1568.002 - Dynamic Resolution: Domain Generation Algorithms] (Implicit in cloud service abuse)
- [T1090.003 - Proxy: Multi-hop Proxy] (SOCKS5 via Teams TURN relays)
- **[TA0006 - Credential Access]**
- [T1110 - Brute Force] (Credential harvesting via fake lock screens)
- **[TA0008 - Lateral Movement]**
- [T1021.001 - Remote Services: Remote Desktop Protocol]
- [T1021.006 - Remote Services: Windows Remote Management]
## Functionality
### Core Capabilities
- **Cloud-Native C2:** Uses SharePoint Online as a "dead-drop" for tasking. It polls a SharePoint drive every 15 seconds for new instructions via the Microsoft Graph API.
- **Traffic Masking:** Launches a headless instance of the victim's Edge browser to drive Graph API traffic, making the C2 communication appear as legitimate user activity.
- **Credential Harvesting:** Deploys "pixel-perfect" fake Windows lock screens (triggered by the `credz_waiting` command) to trick users into entering their system passwords.
### Advanced Features
- **Interactive Relay:** Uses Microsoft Teams TURN (WebRTC) servers to facilitate a reverse SOCKS5 tunnel. This allows the operator to pivot into the internal network through the compromised host.
- **Hardening:** The Python code is obfuscated and protected using PyArmor to hinder static analysis and reverse engineering.
- **Encrypted Exfiltration:** Captured credentials and task outputs are encrypted before being uploaded to the attacker-controlled SharePoint drive.
## Indicators of Compromise
- **File Names:** `bootstrap-fat.pyc` (39 MB compiled payload)
- **Process Behaviors:** `pythonw.exe` initiating outbound connections to internal targets on ports 445 (SMB), 3389 (RDP), 5985 (WinRM), and 1433 (MSSQL).
- **Network Indicators:**
- Outbound TLS/WebSocket connections to attacker-controlled infrastructure.
- Unusual volume of Microsoft Graph API traffic originating from a headless `msedge.exe` process.
- WebRTC/TURN traffic originating from non-Teams processes or directed to unknown Azure tenants.
## Associated Threat Actors
- **Unknown:** Currently attributed to an unnamed group described as highly knowledgeable in offensive tradecraft and Microsoft’s cloud architecture.
## Detection Methods
- **Behavioral Detection:** Monitor for headless browser processes (Edge/Chrome) communicating extensively with `graph.microsoft.com`.
- **Network Monitoring:** Inspect WebRTC/TURN traffic for unusual patterns or connections originating from `pythonw.exe` or other unauthorized binaries.
- **Endpoint Monitoring:** Detect the execution of large `.pyc` files or the presence of PyArmor-protected scripts in temporary directories.
- **UI Monitoring:** Look for unauthorized processes attempting to create full-screen, top-level windows that mimic the Windows Logon UI.
## Mitigation Strategies
- **Social Engineering Training:** Educate users on the risks of running PowerShell commands provided by "IT Support" via chat platforms like Teams.
- **Conditional Access:** Restrict Azure/Microsoft 365 tenant access to known, managed devices and implement strict policies for Graph API permissions.
- **Network Segmentation:** Implement micro-segmentation to limit the effectiveness of SOCKS5 pivots and lateral movement via RDP/WinRM.
- **Software Restriction:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unauthorized Python runtimes and scripts.
## Related Tools/Techniques
- **Backdoor.Turn:** A Go-based RAT used by the DragonForce ransomware group that also abuses Microsoft Teams TURN relays.
- **GraphSpy / GraphRunner:** Post-exploitation tools that leverage the Microsoft Graph API for data exfiltration and persistence.