Key Takeaways
- TWINLOOT is a modular Python implant that hides its command‑and‑control (C2) infrastructure inside legitimate Microsoft services such as SharePoint Online, Teams TURN relays, and the victim’s own Edge browser.
- The malware uses two parallel channels: a SharePoint “dead‑drop” for tasking every 15 seconds and a reverse SOCKS5 tunnel (direct TLS/WebSocket or via Teams TURN WebRTC) for interactive access and lateral movement.
- Credential harvesting is achieved through pixel‑perfect fake Windows lock screens; entered passwords are encrypted, uploaded to SharePoint, and later abused via the SOCKS5 tunnel for RDP/WinRM pivoting.
- Persistence is implemented without admin rights using a combination of COM scriptlet hijacking, TaskCache manipulation, self‑update via a reobf.json manifest, and the open‑source Swarmer tool to create stealthy NTUSER.MAN hive files.
- TWINLOOT shares operational similarities with prior threat actor clusters (e.g., STAC4749) but represents a distinct, freshly‑built framework that combines multiple Microsoft‑service abuse techniques under a single PyArmor‑hardened Python implant.
- The emergence of TWINLOOT, msaRAT, and Backdoor.Turn within a short timeframe highlights a growing trend of attackers leveraging legitimate browser and relay infrastructures (“Ghost Calls”) to evade detection.
Overview of TWINLOOT Discovery
Ontinue’s Cyber Defense Center first observed the TWINLOOT implant during an investigation in July 2026. The framework is a PyArmor‑hardened Python implant designed to operate entirely within trusted Microsoft services, making its traffic blend seamlessly with legitimate enterprise activity. Researchers noted that the implant’s novelty lies in its combination of SharePoint Online dead‑drop C2, Teams TURN relay abuse, and headless browser transport under a single modular architecture.
Initial Infection Vector
The campaign begins with a social engineering attack via Microsoft Teams, where the threat actor poses as IT support and convinces a target to execute a PowerShell command. This command downloads an archive containing the Python runtime and a 39 MB compiled payload (“bootstrap‑fat.pyc”), which acts as a loader for the TWINLOOT framework. The use of a trusted collaboration platform for initial access reduces suspicion and increases the likelihood of successful execution.
Dual‑Channel Command‑and‑Control
TWINLOOT establishes two parallel communication channels from the compromised host. The first channel authenticates to the attacker’s Azure tenant via the Microsoft Graph API and polls a SharePoint Online drive for new tasks every 15 seconds, allowing the operator to issue commands, execute them, and exfiltrate results back to the server. The second channel creates a reverse SOCKS5 tunnel that can operate either as a direct TLS/WebSocket connection to the attacker’s server or through Microsoft Teams TURN relays using WebRTC DataChannels (aiortc). This tunnel provides the operator with a local SOCKS5 listener (127.0.0.1:1080) that proxies traffic into the victim’s internal network, appearing as normal lateral connections from the compromised host.
Credential Harvesting via Fake Lock Screens
To facilitate lateral movement, TWINLOOT harvests Windows credentials through a pixel‑perfect fake lock screen triggered by the “credz_waiting” command. The screen prompts the user for a password; regardless of the input, it displays an error (“The password is incorrect. Try again”) encouraging a second attempt. Once a password is entered, the screen closes, the credential is encrypted, and uploaded to the SharePoint dead‑drop. The harvested credentials are then abused through the SOCKS5 tunnel to pivot to additional hosts using RDP (port 3389), WinRM (5985), SMB (445), or MSSQL (1433).
Persistence Mechanisms Without Admin Rights
Persistence is configured based on the PERSIST_ENABLED flag and employs four techniques. First, a TypeLib COM scriptlet hijack registers malicious code to run at startup. Second, GhostTask‑style TaskCache manipulation creates scheduled tasks that survive reboots. Third, a self‑update routine reads a reobf.json manifest to fetch newer versions of the implant. Fourth, the implant leverages the open‑source Swarmer tool to generate a stealthy NTUSER.MAN hive file using RegLoadAppKeyW and Microsoft’s offline registry library (offreg.dll). When Windows loads the user profile, it prioritizes NTUSER.MAN over NTUSER.DAT, allowing the attacker to maintain foothold without administrative privileges.
Additional Capabilities and Fallbacks
Beyond C2 and persistence, TWINLOOT includes reconnaissance modules for system discovery, screenshot capture, and the ability to fall back to an EtherHiding‑style mechanism if the Azure Blob Storage dead drop fails. The Ethereum‑based resolution component is present in the codebase but unused in the current build, indicating ongoing development and experimentation with alternative covert channels.
Context Within Recent Threat Trends
TWINLOOT is not the first abuse of Microsoft TURN relays; in June 2026, Symantec and Carbon Black reported DragonForce ransomware’s Backdoor.Turn using QUIC sessions via Teams TURN. More recently, a Rust‑based RAT named msaRAT (linked to the Chaos ransomware group) employed the same TURN approach but against Twilio, controlling a headless browser through the Chrome DevTools Protocol. Ontinue notes that the rapid, independent adoption of this “Ghost Calls” technique by multiple actors underscores its effectiveness for evading network‑based detection.
Attribution and Relationship to Known Clusters
While the exact identity of the TWINLOOT developers remains unknown, Ontinue observes operational overlaps with the STAC4749 cluster, known for Teams‑based voice phishing (vishing) campaigns that deploy Chaos ransomware. Both clusters utilize Teams lure delivery, PyArmor‑obfuscated Python backdoors, reverse SOCKS5 proxies, and HKCU Run‑Key persistence. However, the underlying implementation differs markedly: STAC4749 relies on PyInstaller, Go‑based implants, standalone SOCKS5 tools, and .top domains behind Cloudflare, whereas TWINLOOT uses raw .pyc execution, pure Python, an integrated SOCKS5 multiplexer, and aged domains paired with SharePoint dead‑drop C2. If they are the same operator, the tooling appears to have been rebuilt from scratch rather than incrementally evolved.
Conclusion
TWINLOOT exemplifies a sophisticated, multi‑vector threat that weaponizes legitimate Microsoft services to conceal its activities. By combining SharePoint dead‑drop tasking, Teams TURN‑relayed WebRTC channels, headless browser transport, credential‑stealing fake lock screens, and resilient persistence mechanisms—all without requiring admin rights—the implant presents a significant challenge for defenders. Its emergence alongside similar tools such as msaRAT and Backdoor.Turn signals a broader shift toward “living‑off‑the‑cloud” techniques, necessitating updated detection strategies that monitor anomalous use of Microsoft Graph, Teams TURN relays, and headless browser behavior within enterprise environments.