TWINLOOT Python Implant Leverages Microsoft Services for Stealth C2

Post Views: 6

A previously unidentified Python-based malware strain named “TWINLOOT” has been identified using multiple legitimate Microsoft services to conceal its command-and-control (C2) traffic from security systems.

C2 operations utilize Microsoft’s infrastructure

The malware employs two distinct C2 channels to maintain covert communication. The first is a persistent “tasking channel” that leverages a SharePoint “dead-drop” mechanism, polling for instructions every 15 seconds. Attackers host a custom Azure tenant and SharePoint drive, with all outbound traffic from compromised systems directed to Microsoft domains such as login.microsoftonline.com, graph.microsoft.com, and kerteransens.sharepoint.com.

The malware connects via the Chrome DevTools Protocol over a local WebSocket

“The malware connects via the Chrome DevTools Protocol over a local WebSocket, navigates to graph.microsoft.com, and executes Graph API calls as same-origin ‘fetch()’ requests within the browser context,” researchers detailed.

The second C2 channel establishes a reverse SOCKS5 tunnel

The second C2 channel establishes a reverse SOCKS5 tunnel, enabling attackers to maintain interactive access and facilitate lateral movement. While direct TLS/WebSocket connections are possible, the malware also exploits Microsoft Teams’ Traversal Using Relays around NAT (TURN) infrastructure to mask traffic within legitimate Teams communications.

“This approach undermines security measures relying on domain reputation, IP blocking, or assumptions about Microsoft 365 traffic being benign,” Jason Soroko, a senior fellow at Sectigo, explained.

Credential harvesting and lateral movement mechanisms

The malware includes a module for stealing credentials by displaying a counterfeit Windows lock screen. Upon receiving a “credz_waiting” command, TWINLOOT generates a visually accurate fake lock screen using Tkinter, replicating the victim’s real display name, account image, and wallpaper.

Researchers noted that the presence of python.exe initiating outbound connections

Researchers noted that the presence of python.exe initiating outbound connections to administrative ports (445, 3389, 5985, 22, 1433, 135, 389) on multiple internal IPs represents anomalous behavior.

“When malicious traffic blends seamlessly with normal user activity, traditional detection methods fail. Security teams must establish baselines for SharePoint, Teams, and Graph API interactions and monitor deviations,” said Shane Barney, CISO at Keeper Security.

Infrastructure and operational timeline

The threat actor behind TWINLOOT established its infrastructure over seven weeks, repurposing two recently expired domains to exploit “reputation-inheritance.” The malware’s full capabilities include system reconnaissance, screenshot capture, configuration loading, polling interval adjustments, and execution of arbitrary shell commands.

Security experts advise prioritizing monitoring of irregular Microsoft Graph API activity

Security experts advise prioritizing monitoring of irregular Microsoft Graph API activity, auditing OAuth applications and consent grants, and investigating anomalies in SharePoint and Teams interactions.

“Organizations should enhance behavioral analytics and user/entity behavior analytics (UEBA) capabilities while expanding detection beyond traditional indicators like registry changes or administrative actions,” recommended Robert Coles, senior manager of threat intelligence at Black Duck.