"TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News.
How TWINLOOT hides C2 inside Microsoft services
Ontinue's Cyber Defense Center reported the discovery of TWINLOOT during an investigation of an active campaign in July 2026. The implant centralizes its command-and-control (C2) infrastructure inside Microsoft services: SharePoint Online via the Microsoft Graph API for tasking, and Microsoft Teams TURN relays for interactive operator access. Traffic to and from the Graph API is driven by a headless instance of the victim's own Edge browser, a tactic Ontinue says makes the activity "virtually indistinguishable from legitimate network activity."
TWINLOOT drives SharePoint interactions through the Drive API after connecting the headless browser to graph.microsoft[.]com. Tasking is polled from the SharePoint drive every 15 seconds, allowing the operator to receive instructions, run them, and exfiltrate data back over the same channel.
Initial access: Teams social engineering and a 39 MB bootstrap
Ontinue assessed the initial access vector as a social engineering attack conducted over Microsoft Teams. In the observed campaign the actor, masquerading as IT support, persuaded a target to run a PowerShell command that downloaded an archive containing the Python runtime and a 39 MB compiled payload named "bootstrap-fat.pyc." That payload serves as the loader for the TWINLOOT framework.
Ontinue calls the framework notable as "the first such tool to combine Microsoft 365 dead drop C2, Teams TURN relay abuse, and headless browser transport under a single umbrella."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCredential theft and lateral movement via fake lock screens and SOCKS5 pivots
TWINLOOT provides two parallel channels from the compromised host. The SharePoint dead-drop channel handles tasking and exfiltration; the second channel establishes a reverse SOCKS5 tunnel that grants interactive access and a route for lateral movement. The implant can run the tunnel directly over TLS/WebSocket to an attacker server or relayed through Teams TURN using WebRTC DataChannels implemented with aiortc.
Ontinue described the operator workflow: the attacker runs a SOCKS5 listener on their machine (127.0.0.1:1080) and proxies traffic into the victim's internal network. From the victim's perspective, the connections originate from pythonw.exe and target common internal services such as SMB (port 445), RDP (3389), WinRM (5985), and MSSQL (1433).
To obtain credentials for lateral movement the framework renders a pixel‑perfect fake Windows lock screen when the operator issues the "credz_waiting" command. The fake prompt displays "The password is incorrect. Try again" after any entry; Ontinue notes the implant does not validate the first input against Windows authentication and that victims are likely prompted to re-enter the correct password. Each captured password is encrypted and uploaded to the SharePoint drive, then abused through the SOCKS5 tunnel to pivot to additional hosts using RDP or WinRM.
Persistence techniques: COM hijack, TaskCache, self-update, and NTUSER.MAN hives
TWINLOOT's persistence options vary by build but include four documented methods: a TypeLib COM scriptlet hijack; GhostTask‑style TaskCache manipulation; a self-update mechanism driven by a reobf.json manifest; and a technique using Praetorian's open-source tool Swarmer to create stealthy HKCU registry keys without admin privileges.
Ontinue explains that the Swarmer-based method builds a mandatory Windows profile hive offline using RegLoadAppKeyW and Microsoft's offline registry library offreg.dll (ORCreateKey, ORSetValue, ORSaveHive). The resulting hive is written to %USERPROFILE%\\NTUSER.MAN. Because Windows checks NTUSER.MAN before NTUSER.DAT, an attacker-controlled NTUSER.MAN can override HKCU behavior. Ontinue said this is the first recorded malicious use of this persistence method in the wild.
How defenders, enterprises, and researchers should follow the TWINLOOT trail
- Technologists and security teams: Watch for unusual Edge headless instances with remote debugging enabled and Graph API activity originating from user workstations; the SharePoint polling cadence (every 15 seconds) and large Python runtime artifacts (the observed "bootstrap-fat.pyc" at 39 MB) are concrete indicators mentioned by Ontinue.
- Enterprises and procurement leaders: Note the actor's use of trusted cloud services and aged drop domains; the implant's ability to ferry C2 through legitimate Microsoft infrastructure complicates reliance on simple allowlists or network-blocking strategies.
- Researchers and incident responders: Compare TWINLOOT to other recent relay‑abuse cases. Ontinue linked operational convergence with other tools: Broadcom-owned Symantec and Carbon Black described DragonForce ransomware's Backdoor.Turn in June 2026, which hides C2 inside Teams relays using QUIC; and Cisco Talos detailed msaRAT, a Rust RAT that drives a headless browser via Chrome DevTools Protocol to establish WebRTC through Twilio TURN. TWINLOOT differs in implementation—raw .pyc execution, pure Python, aiortc WebRTC DataChannels, and SharePoint dead-drop C2.
Ontinue noted overlaps with a cluster it calls STAC4749—Teams vishing delivery, PyArmor obfuscation, reverse SOCKS5, HKCU Run key persistence and an adjacent timeline—but emphasized the implementation differences: STAC4749 used PyInstaller, Go implants and .top domains, while TWINLOOT uses raw .pyc execution, an integrated SOCKS5 multiplexer, and SharePoint dead-drop C2. Whether these parallels reflect the same operator rebuilding tooling or distinct groups independently converging on similar techniques remains unstated.
TWINLOOT illustrates a broader pattern: multiple operators are independently adapting browser-driven, TURN‑relay and cloud‑service C2 techniques that were publicly described within the last year. That convergence—tools that never touch the open network directly, instead offloading signaling and data transport into trusted browser sessions and cloud relays—raises a clear tactical challenge for defenders who must now distinguish malicious use of legitimate services from benign activity.
Source: The Hacker News — TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
