TWINLOOT: When Microsoft Cloud Becomes a Hacker's "Control Center"

Imagine a nightmare scenario for every SOC team: An attacker lies deep inside the internal network for weeks, silently opening up to 128 administrative connection streams (SMB, RDP, WinRM) to move laterally, but the EDR system does not turn on a single alert, and the enterprise's Entra ID (Azure AD) log does not record a single strange log line at all.

That is not an academic hypothesis. That's how the newly discovered Python malware framework called TWINLOOT has bypassed enterprise network defenses.

Protected with PyArmor 9.2.5 Pro, TWINLOOT does not need to build its own C2 server but operates 100% of the control commands hidden within the trusted IP range of Microsoft 365, SharePoint and Teams. By "borrowing" the Edge browser in hidden mode (Headless Edge via CDP) to broadcast Graph API and turning the Microsoft Teams TURN Relay infrastructure into a reverse SOCKS5 bridge, TWINLOOT turns the infected workstation itself into a completely legitimate pivot point.

Not only that, TWINLOOT is also the first malware to successfully weaponize the stealth technique "Corrupting the Hive Mind" - automatically creating an offline NTUSER.MAN Registry profile file to maintain access rights (Persistence) without requiring Administrator rights and without generating any Registry recording events on the system.

Attack Chain

TWINLOOT's attack campaign was methodically orchestrated from the stage of preparing the infrastructure to the step of infiltrating and taking control.

Detailed implementation steps:

1. Prepare infrastructure: The attacker collects drop-caught aged domains 7 weeks in advance to bypass newly created domain name filtering systems, at the same time registers their own application on Azure AD and creates a SharePoint site as a transit warehouse.

2. Initial intrusion: The attacker performs Vishing (Voice Phishing) techniques or sends direct messages on Microsoft Teams, impersonating internal IT support staff to instruct the victim to run a PowerShell command.

3. Load Payload (Staging): The PowerShell command downloads a compressed file containing the main Python 3.12.9 runtime environment (Python embeddable runtime – retains valid Authenticode signature) and a 39 MB bootstrap-fat.pyc loader file (contains a 29 MB source code ZIP).

4. Decoding Stage-1: Windowless executable loader (pythonw.exe), unit lock check (PID lockfile), dependency extraction and GUI environment initialization (Tcl/Tk). All 115+ core modules are dynamically decoded from the PyArmor 9.2.5 Pro protection layer.

5. Activate C2 Parallel: Simultaneously set up the SharePoint Dead-drop channel (asynchronous work assignment) and the Teams TURN SOCKS5 Proxy channel (real-time operation).

Detailed Technical Analysis of TWINLOOT Malware Framework

Dual-Channel C2 Architecture & Hidden Breakthrough

TWINLOOT operates two separate communication channels originating from the same pythonw.exe process on the victim machine

Channel 1: SharePoint Online Dead-Drop (Tasking & Exfiltration)

• Mechanism: The malicious code broadcasts outbound HTTPS requests every 15 seconds to the SharePoint Drive located at the attacker's own Azure Tenant (kerteransens.sharepoint.com).

• Defense blind spot: Because the malware authenticates itself directly with the embedded attacker's Tenant ID and Credential, the entire authentication log (Entra ID Audit Logs / Sign-in Logs) on the victim's Tenant does not record any abnormalities at all.

Channel 2: Reverse SOCKS5 via Teams TURN WebRTC DataChannel (Interactive Lateral Movement)

• Mechanism: For real-time interactive operation, TWINLOOT creates a reverse SOCKS5 bus. The data traffic is encapsulated into the WebRTC DataChannel (using the Python aiortc library) and transmitted through the official Microsoft Teams TURN relay server (turns:worldaz-msit.relay.teams.microsoft.com:443).

• Automatic Credential Collection: Malware does not use TURN credential hardcode. It automatically sends an unauthenticated HTTP POST to the current Teams API (teams.microsoft.com/api/authsvc/v1.0/authz/visitor) with the Ms-Teams-Auth-Type: ExplicitLogin header to get a Skype token, then exchange it for a TURN Username/Password valid for 1 hour.

• Actual harm: The attacker opens a SOCKS5 Listener port (127.0.0.1:1080) right on his computer. All attack traffic (SMB/445, RDP/3389, WinRM/5985, MSSQL/1433) when going through this tunnel will "exit" directly from the pythonw.exe process on the victim machine towards the internal network. To an internal network monitoring system, this looks like a regular administrative connection from the user's workstation. This channel supports up to 128 concurrent TCP streams.

Hidden Browser Control Techniques

Here is the most sophisticated point in TWINLOOT's EDR evasion ability:

• Instead of using Python's HTTP library (like urllib or requests) to send requests directly to the Graph API (a behavior easily caught by EDR with the "Process python.exe making external network connections" rule), TWINLOOT launches the Microsoft Edge browser in hidden mode:

msedge.exe --headless --remote-debugging-port=9222 --user-data-dir=...

• The malware connects to Edge via the Chrome DevTools Protocol (CDP) using an internal WebSocket. Through the Runtime.evaluate command, it inserts JavaScript code that emits the fetch() function directly in the context of the graph.microsoft.com page.

• Consequence: From a Process Telemetry and Network Telemetry perspective, the system only sees the valid process msedge.exe connecting HTTPS to the Microsoft graph.microsoft.com address. EDR rules based on the process name create a completely disabled network connection.

Collect Passwords via Fake Lock Screen

Upon receiving the credz_waiting command from SharePoint C2, TWINLOOT immediately displays a simulated Windows lock screen:

• Absolute fidelity: The malware queries the GetUserNameExW API to get the real display name, extracts the user avatar in %APPDATA%\Microsoft\Windows\AccountPictures, and gets the real lock screen wallpaper from the CSP/Spotlight Registry keys.

• Transition cover: A black flash-cover is displayed for 250ms to hide the transition between real and fake screens.

• Dual-Attempt Capture: This lock screen does not check the correctness of the password with Windows Authentication. Regardless of what the user enters the first time, the interface returns the error message "The password is incorrect. Try again." The user will reflexively retype the correct password the second time. The fake screen then closes on its own. The malicious code packages the entire 1st and 2nd typed password string, encrypts it, and pushes it to SharePoint Drive.

• The stolen password is immediately used to escalate privileges and move across the Reverse SOCKS5 Proxy channel.

Persistence Technique "Corrupting the Hive Mind"

TWINLOOT supports 4 access retention mechanisms, the most notable of which is the Offline Mandatory Profile Hive Forging technique based on Praetorian research (January 2026), recorded for the first time used in a real campaign:

NTUSER.MAN's technical breakthrough:

• No need for Admin rights: The file is located in the user's Profile folder.

• Bypass EDR/SIEM: The Registry file is built offline using DLL and written to disk as a binary file, completely without generating any Registry write events (Registry modification event / Sysmon Event ID 13) on the live system.

• Other secondary methods: TypeLib COM Scriptlet Hijack (HKCU\Software\Classes\TypeLib... only targets Config.sct), GhostTask Scheduled TaskCache manipulation (writes directly to HKLM\Schedule\TaskCache bypassing SD value making schtasks /query invisible), and Auto-update mechanism via reobf.json.

Scalability & Attack Infrastructure Preparation

• Diverse set of commands:

  • recon: Collect system information via NetAPI (NetServerEnum, NetGroupGetUsers, DsEnumerateDomainTrustsW) – does not call WMI or cmd.exe at all.

  • screenshot: Take a screenshot using PowerShell one-liner.

  • tunnel/turn: Controls turning WebSocket and Teams TURN streams on/off.

  • Arbitrary Command Execution: All commands not in the above list are passed directly to the subprocess with shell=True, timeout 120s, 65KB output limit and CREATE_NO_WINDOW flag.

MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Description of Application in TWINLOOT
Initial Access	T1566.003	Phishing: Spearphishing via Service	Uses vishing/Microsoft Teams messages to impersonate IT Support.
Execution	T1059.006	Command and Scripting Interpreter: Python	Executes code via Python 3.12.9 embeddable runtime and .pyc files.
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys	Abuses NTUSER.MAN profile hive forging and TypeLib COM Hijacking.
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task	Uses the GhostTask technique to overwrite TaskCache, hiding it from schtasks.
Defense Evasion	T1027.002	Obfuscation: Software Packing	Packs source code using PyArmor 9.2.5 Pro (License 011971).
Defense Evasion	T1562.001	Impair Defenses: Disable/Modify Tools	Runs Edge CDP in Headless mode to bypass EDR process detection.
Credential Access	T1056.002	Input Capture: GUI Input Capture	Simulates the Windows lock screen using Tkinter/HTML to harvest passwords.
Discovery	T1087.002	Account Discovery: Domain Account	Queries Domain Admins and Trust via the NetGroupGetUsers API.
Command & Control	T1071.001	Application Layer Protocol: Web Protocols	Uses Microsoft Graph API pointing to SharePoint Drive over HTTPS.
Command & Control	T1567.002	Exfiltration to Cloud Storage	Exfiltrates collected data and credentials to SharePoint Drive.
Command & Control	T1090.003	Proxy: Multi-hop Proxy	Creates a multi-threaded Reverse SOCKS5 Tunnel via Teams WebRTC TURN Relay.

Expert Comments

Sophistication & Speed of attack technology transfer

TWINLOOT proves a worrying reality: The gap between academic research/security conferences (Hacking Conferences) and actual weaponization of malware has shortened to just weeks.

• Teams TURN relay abuse technique announced at Black Hat USA 2025 (Praetorian's TURNt tool). By mid-2026, we will see DragonForce (Backdoor.Turn) and TWINLOOT simultaneously put into real combat.

• The NTUSER.MAN ("Corrupting the Hive Mind") technique just appeared in a research report in early 2026 and by July 2026 was completely embedded into TWINLOOT.

"Living Off the Cloud" Trend & The Decline of the Traditional IOC Index

The fact that TWINLOOT places the entire C2 channel inside Microsoft's trusted infrastructure (SharePoint, Teams, Azure) makes the traditional IP/Domain Reputation based monitoring concept completely disabled. Network firewalls or Secure Web Gateway (SWG) cannot block Microsoft IP ranges without disrupting business operations.

Context for businesses in Vietnam

In Vietnam, the explosion of the digital transformation model and the widespread application of the Microsoft 365 / Teams solution set in corporations, financial and banking organizations makes the risk from TWINLOOT extremely present. The attacker takes advantage of absolute trust in notifications/calls from the internal Teams application to perform the initial intrusion step.

Recommendations for Real Battle Defense

Immediate Phase (0 - 24 hours)

1. Monitor external SharePoint connections: Configure EDR / CASB / SWG to warn or immediately block management workstations connecting to hostnames of the type *.sharepoint.com that are not on the enterprise's official Tenant ID list. TWINLOOT is required to send data to the attacker's Tenant SharePoint.

2. Lock Headless Mode & Remote Debugging feature on Edge: Deploy Intune / Group Policy to disable Edge browser background flag on regular workstations:

   • HeadlessModeEnabled ➔ Disabled (Path: Microsoft Edge > Control use of the Headless Mode)

   • RemoteDebuggingAllowed ➔ Disabled (Path: Microsoft Edge > Allow remote debugging) (Note: These two policies completely break TWINLOOT's Edge CDP mechanism).

Short-Term Phase (1 - 7 days)

1. Detect unusual Python processes: Set EDR/SIEM rules to warn of python.exe or pythonw.exe processes launching from User-writable paths such as:

   • %APPDATA%\...

   • %LOCALAPPDATA%\...

   • %TEMP%\...

   • C:\ProgramData\...

2. Monitor internal network scanning behavior (Process Anomaly): Warn when the pythonw.exe process generates connections to multiple internal IP addresses on administrative ports: 445 (SMB), 3389 (RDP), 5985 (WinRM), 1433 (MSSQL), 389 (LDAP).

3. Revoke session when suspected of revealing Password: If you detect a workstation suspected of being infected with TWINLOOT, immediately change the user account password and revoke the authentication token via PowerShell Entra ID

Long Term Phase (Architecture & Process)

1. Mandatory Phishing-Resistant Authentication (FIDO2 / Passkey): Deploy FIDO2 keys or Passkeys across the entire organization. When traditional hand-typed passwords are no longer used, TWINLOOT's method of stealing passwords with fake lock screens is completely ineffective.

2. Tighten external connection policy on Microsoft Teams: Limit or turn off the "External Access" feature (allowing external Teams accounts to text/call internal employees) if there is no need for extensive external communication.

Indicators of Compromise (IOCs) & References

File Hashes

• 7d8f9e0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e

• a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b

Network & C2 Artifacts

• sharepointx.th2ch[.]com

• 193.24.211[.]22

• kerteransens.sharepoint[.]com

• turns:worldaz-msit.relay.teams.microsoft[.]com

References

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 & Azure

'TwinLoot' Cyber Threat Operates Entirely From Microsoft's Cloud