A newly discovered Python implant called “TWINLOOT” abuses multiple trusted Microsoft services to hide its command-and-control (C2) communications from security tools, Ontinue
reported Tuesday.
The implant aims to evade detection by ensuring defenders only see connections to legitimate Microsoft services and IPs rather than unknown external domains, making it more challenging for organizations to block attacks.
“This weakens controls built around domain reputation, IP blocking, process names, or the assumption that Microsoft 365 traffic represents sanctioned user activity,” Jason Soroko, senior fellow at Sectigo, told SC Media.
The attack begins with social engineering via Microsoft Teams, with an attacker impersonating IT staff and luring a victim to run a PowerShell command that downloads a malicious archive, Ontinue said.
This archive contains a Python 3.12.9 runtime and a loader called bootstrap-fat.pyc, which carries an additional embedded archive protected by PyArmor 9.2.5 Pro encryption. The encrypted archive contains dependencies and about 120 malware modules, 115 of which Ontinue managed to recover using the open-source
Pyarmor-Static-Unpack-1shot tool for static analysis.
C2 channels abuse trusted Microsoft services
The implant uses two parallel C2 channels to conduct malicious activities, each of which uses a different Microsoft service to hide its communications. The first is an “always-on tasking channel” that uses a SharePoint “dead-drop” that is polled every 15 seconds for commands.
The attacker hosts their own Azure tenant and SharePoint drive, with all outbound traffic from the victim endpoint going to Microsoft domains: login[.]microsoftonline[.]com, graph[.]microsoft[.]com and kerteransens[.]sharepoint[.]com.
Rather than contacting the Microsoft Graph API directly from the Python process, which could be caught by detection rules, TWINLOOT launches a headless Microsoft Edge browser so that communications go through the msedge.exe process and look like legitimate activity.
“It attaches via the Chrome DevTools Protocol over a local WebSocket, navigates a tab to graph.microsoft[.]com, and issues all Graph API calls as same-origin ‘fetch()’ requests from within the browser page context via Runtime.evaluate,” Ontinue explained.
The second C2 channel is a reverse SOCKS5 tunnel that services as an “interactive access channel” for the attacker and a path for lateral movement. While the malware supports the option of a direct TLS/WebSocket connection to the attacker’s server, it also allows for the use of Microsoft Teams’ Traversal Using Relays around NAT (TURN) infrastructure to hide the connection within Teams traffic.
This evasion technique is derived from a technique developed by Praetorian dubbed “
TURNt,” and Ontinue notes TWINLOOT was the second observed case of a threat actor using Teams TURN relay abuse to disguise C2 traffic in the wild, after the
DragonForce ransomware group used another variant of the technique for its Backdoor.Turn malware earlier this year.
In this case, TWINLOOT uses a custom Python port of the Praetorian TURNt tool. The malware obtains a Teams anonymous visitor Skype token which delivers one-hour TURN credentials used to establish WebRTC DataChannels with traffic relayed through a Teams TURN relay server. Session Description Protocol (SDP) offers and answers are sent through the SharePoint dead-drop, avoiding direct connections to the attacker server.
“When the attacker’s traffic is genuinely indistinguishable from a normal user’s activity, signature-based detection and process monitoring are not going to catch it. Security teams need to know what normal looks like for every account touching SharePoint, Teams, and Graph API integrations, and they need to be alerting on deviations from that baseline,” said Shane Barney, CISO at Keeper Security, in an email to SC Media.
Lateral movement and novel persistence technique
To facilitate lateral movement, the malware collects credentials by displaying a “pixel-faithful” fake Windows lock screen upon receiving a command called “credz_waiting.” TWINLOOT uses Tkinter-based kits to create both Windows 10 and Windows 11 lock screens that populate the victim’s real display name, account image and lock screen wallpaper based on system data.
The fake lock screen collects the victim’s password twice — always displaying an error screen after the first attempt and performing no validation on either attempt — and the user’s inputs are uploaded to the SharePoint dead drop.
“The credential harvesting piece is particularly important for defenders to understand. Every login attempt gets collected regardless of whether it succeeds, and the victim has no indication anything is wrong. They see a standard incorrect-password prompt, try again and eventually authenticate normally. The attacker gets valid credentials and no failed login event fires,” Barney noted.
The password is then sent back through the SOCKS5 tunnel and used to establish Remote Desktop Protocol (RDP), Server Message Block (SMB) and Windows Remote Management (WinRM) connections to other hosts on the local network that the victim can reach.
“The detection seam is the process: python.exe fanning out to multiple internal IPs on administrative ports (445, 3389, 5985, 22, 1433, 135, 389) is not normal workstation behaviour, regardless of what credentials are being used,” the Ontinue researchers noted.
The malware uses multiple methods for persistence, including TypeLib COM scriplet hijacking and TaskCache manipulation, but the most notable is a technique called “Corrupting the Hive Mind,” which was
published by Praetorian in January 2026 and not previously seen in the wild.
TWINLOOT creates a mandatory Windows profile hive by leveraging RegLoadAppKeyW and offreg.dll and writes it to %USERPROFILE%\NTUSER.MAN, triggering a mandatory profile override when Windows loads a user profile, which ensures the malware survives logouts. Ontinue notes that this requires no administrative privileges and that the hive is built offline, meaning no registry modification events are generated.
The threat actor behind TWINLOOT was found to have staged its infrastructure over a seven-week time period, purchasing two recently expired domains to leverage “reputation-inheritance,” Ontinue said.
The full command set for TWINLOOT also includes system reconnaissance, screenshot capabilities, configuration loading, polling interval adjustment and arbitrary shell command execution.
“Security teams should prioritize monitoring unusual Microsoft Graph API activity, auditing OAuth applications, and consent grants, investigating anomalous SharePoint and Teams activity, detecting browser automation and abuse of legitimate processes, and correlating identity, endpoint, and cloud telemetry,” Robert Coles, senior manager of threat intelligence at Black Duck, said in comments to SC Media. “They should also invest in behavioral analytics and user/entity behavior analytics (UEBA) capabilities while expanding detections beyond traditional indicators such as registry modifications or administrative actions.”
Ontinue further recommends restricting Teams external access when it is not required to help prevent Teams-based social engineering, disable headless mode and remote debugging for Microsoft Edge when it is not needed, monitor for execution of Python processes from unusual user-writable paths and using phishing-resistant authentication methods such as passkeys and FIDO2 keys.
