Malware Exploits Microsoft Ecosystem for Covert Command-and-Control Operations

Security analysts have identified a sophisticated Python malware framework, dubbed TWINLOOT, which cleverly routes its command-and-control (C2) communications through familiar Microsoft services. This approach undermines traditional defense mechanisms, as organizations typically regard Microsoft traffic as benign. As organizations increasingly rely on cloud services, malware like TWINLOOT represents a new frontier in cyber threats that exploits the very technologies businesses have come to trust.

Weaponizing Trust: How TWINLOOT Operates

Uncovered by the Ontinue Cyber Defense Center during an investigation in July, TWINLOOT relies on platforms like SharePoint Online and Microsoft Teams to establish its operational foothold. The malware utilizes SharePoint as a dead drop for file storage and employs the TURN infrastructure of Microsoft Teams for interactive sessions. This allows TWINLOOT to conduct operations without relying on overtly suspicious, attacker-owned domains, which are typically easy targets for cybersecurity teams.

Shane Barney, Chief Information Security Officer at Keeper Security, emphasizes the strategic advantage this gives the malware: “TWINLOOT works because defenders have been trained to treat Microsoft traffic as safe by default. There’s no attacker-controlled domain in the chain, meaning the traffic behaves just like legitimate communications.” This camouflage poses significant challenges for detection systems, which tend to overlook such traffic. With security teams inundated with alerts, it's easy for them to miss subtle signs of intrusion, particularly when the malicious payload is masquerading as normal corporate activity.

Adapting Within the Trust Boundary

TWINLOOT’s architecture smartly separates its execution tasks into routine operations and live interactions. Through its SharePoint channel, the malware polls for commands every 15 seconds while also exfiltrating stolen credentials and reconnaissance data back to the attacker. This dual functionality allows the malware to operate undetected for longer periods, gathering intelligence before executing more damaging commands.

The malware authenticates to a malicious Azure tenant instead of the victim’s Microsoft 365 account, which results in no relevant entries in the victim’s Entra ID logs. This evasion technique protects its malicious activities from routine monitoring. By staying off the radar, TWINLOOT can persist within target environments, potentially leading to escalated privileges and further infiltration.

For real-time access, TWINLOOT can initiate a reverse SOCKS5 tunnel, using Microsoft Teams’ TURN for secure communications. This method allows attackers to access the internal network as if the traffic originated from the victim’s device, effectively masking the operation. The ability to create this tunnel without raising alarms means that organizations could be sitting on a time bomb, with intruders operating within their networks for an extended period.

The creative use of Teams TURN marks TWINLOOT as only the second malware instance leveraging this technique in the wild, and the first to integrate WebRTC DataChannels—a notable evolution in how malware can interact with communications platforms. This is more significant than it appears; it signals a shift towards increasingly complex attacks that are harder to detect and counter.

In another sophisticated maneuver, the malware launches a headless version of Microsoft Edge, attaching itself using the Chrome DevTools Protocol. It sends requests through the Graph API, appearing as a legitimate Edge process communicating with Microsoft—a significant detection hurdle, according to researchers. This kind of blending in makes the task of distinguishing between benign and malicious activity all the more daunting for cybersecurity teams.

Robert Coles, Senior Manager of Threat Intelligence Security at Black Duck, highlights the trend of attackers hiding within trusted cloud services rather than relying on their own infrastructure. He advises organizations to enhance their defenses by implementing behavioral detection, closely monitoring identity activities, and watching for anomalies in Graph API engagements, OAuth consent grants, and irregular SharePoint and Teams interactions. What this means for you is that an expanded focus on user behavior could be key to spotting TWINLOOT before it causes real damage.

Credential Theft and Sustained Access

When prompted, TWINLOOT can display a Windows lock screen that reflects the victim’s actual account information. Notably, it doesn't validate passwords; instead, it captures each attempt, encrypting the data and sending it back to the SharePoint C2 channel. The victim sees a normal message for incorrect entries before realizing their access has been compromised. This deception is alarming, as customers are often conditioned to trust what they see on their machines, making them unsuspecting accomplices in their own breach.

This tactic enables lateral movement through the reverse SOCKS tunnel, facilitating unauthorized access to other systems using protocols like RDP, SMB, or WinRM. It raises the stakes for organizations, as the potential for broader network reach significantly increases when attackers can pivot from one compromised system to another without triggering alarms.

An innovative persistence method, referred to by Ontinue as “Corrupting the Hive Mind,” allows TWINLOOT to remain on the system without requiring administrator privileges. It generates a Windows “NTUSER.MAN” profile hive offline, evading common detection alerts associated with registry modifications. Such a technique illustrates a growing trend toward camouflage within legitimate user behavior, making the malware even more insidious. (And this is the part most people overlook.)

Defense strategies must adapt accordingly. Ontinue suggests organizations prioritize monitoring for unusual activity within SharePoint, Teams, and Graph API interactions rather than focusing solely on malware signatures. By adopting a holistic approach to monitoring, businesses can better respond to nuanced intrusion tactics, going beyond traditional detection systems that often miss the mark against advanced threats. Additionally, disabling Edge headless mode, scrutinizing Python processes, changing exposed credentials, and employing phishing-resistant authentication are recommended best practices to combat this evolving threat.

Future Outlook: The Implications of TWINLOOT

As cyber threats like TWINLOOT become more sophisticated, organizations face mounting pressure to rethink their security postures. This isn’t just about protecting against malware anymore; it’s about understanding how attackers manipulate trusted services for their gains. Businesses must not only invest in advanced detection technologies but also foster a culture of cybersecurity awareness among employees. What this means is integrating security into everyday operations, rather than treating it as an afterthought.

The implications are far-reaching—security teams will need to be more agile, adapting to a threat environment that learns and evolves faster than they do. The focus must shift toward continuous monitoring and real-time analysis, where the goal is to establish trust boundaries that are much more dynamic. Organizations ignoring this trend might find themselves increasingly vulnerable, as attackers capitalize on the veil of trusted environments.

As we look ahead, the challenge will be to balance convenience in using trusted cloud services with the need for rigorous security protocols. Finding that equilibrium will be crucial in maintaining not only operational efficiency but also the integrity of organizational data.