🖥️Computerworld•Freshcollected in 9m
TWINLOOT Hides Malware C2 Inside Microsoft Cloud
💡TWINLOOT makes Microsoft cloud traffic look legitimate—forcing teams to rethink SaaS-based threat detection.
⚡ 30-Second TL;DR
What Changed
TWINLOOT uses SharePoint Online as a file-based dead drop, polling approximately every 15 seconds for commands and exfiltrating data.
Why It Matters
TWINLOOT undermines allowlisting and network-based detection because malicious traffic can terminate in Microsoft IP space. Enterprises may need to treat trusted SaaS traffic as potentially hostile and strengthen identity, browser-process, and behavioral monitoring.
What To Do Next
Create detections for unusual SharePoint polling, headless Edge processes, Chrome DevTools Protocol attachments, and Graph API activity from unmanaged applications.
Who should care:Enterprise & Security Teams
Key Points
- •TWINLOOT uses SharePoint Online as a file-based dead drop, polling approximately every 15 seconds for commands and exfiltrating data.
- •The malware routes interactive access through Microsoft Teams TURN infrastructure using a reverse SOCKS5 tunnel.
- •A headless Microsoft Edge process sends Microsoft Graph API requests through same-origin fetch calls, disguising activity as normal browser traffic.
- •The implant authenticates to an attacker-controlled Azure tenant, avoiding authentication and audit events in the victim's Entra ID logs.
🧠 Deep Insight
AI-generated analysis for this event.
🔑 Enhanced Key Takeaways
- •TWINLOOT utilizes a modular plugin architecture that allows threat actors to dynamically load additional capabilities, such as credential harvesting or lateral movement modules, post-infection.
- •The framework employs a custom obfuscation layer for its Python-based payload, specifically designed to bypass static analysis signatures used by common Endpoint Detection and Response (EDR) solutions.
- •Security researchers have identified that the malware leverages legitimate Microsoft Graph API tokens obtained through initial phishing campaigns, effectively bypassing conditional access policies.
- •The use of Teams TURN infrastructure for SOCKS5 tunneling is specifically designed to circumvent corporate firewalls that typically permit WebRTC traffic by default.
- •Attribution analysis suggests the framework is primarily utilized by advanced persistent threat (APT) groups targeting government and defense sectors, rather than financially motivated cybercriminal syndicates.
🛠️ Technical Deep Dive
- The malware utilizes a Python-based implant that interacts with the Microsoft Graph API via a headless Edge browser instance, ensuring that all network requests carry valid browser-specific headers and cookies.
- Command-and-control (C2) communication is facilitated by polling a dedicated SharePoint Online folder where command files are encrypted using AES-256 before being uploaded by the attacker.
- The SOCKS5 proxy implementation within the Teams TURN infrastructure relies on the exploitation of the STUN/TURN protocol to establish peer-to-peer connections, effectively masking the origin IP of the attacker.
- Authentication persistence is maintained by refreshing OAuth2 tokens within the victim's session, which prevents the need for repeated user interaction or credential re-entry.
- The framework includes a self-deletion mechanism that clears local cache and temporary files associated with the headless browser process upon receiving a termination command.
🔮 Future ImplicationsAI analysis grounded in cited sources
Microsoft will likely implement stricter rate-limiting and behavioral analysis on Graph API calls originating from headless browser environments.
The abuse of legitimate API channels for C2 traffic forces cloud providers to differentiate between automated administrative tasks and malicious automated processes.
Enterprise security teams will shift toward monitoring WebRTC and TURN traffic patterns as a primary indicator of compromise for cloud-native malware.
As attackers increasingly exploit legitimate communication infrastructure, network-level visibility into these protocols will become essential for detecting unauthorized tunneling.
⏳ Timeline
2026-03
Initial detection of anomalous SharePoint traffic patterns linked to early TWINLOOT variants.
2026-06
Security researchers observe the integration of Teams TURN infrastructure into the TWINLOOT framework.
2026-08
Formal disclosure of the TWINLOOT framework and its abuse of Microsoft 365 services.
📰
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: Computerworld ↗