TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
TWINLOOT is a modular, PyArmor-hardened Python implant that operates its entire C2 infrastructure inside trusted Microsoft services (SharePoint Online and Microsoft Teams) It uses SharePoint Online file dead-drops via Microsoft Graph API for tasking and WebRTC DataChannels relayed by Teams TURN servers for interactive operator access The implant harvests Windows credentials through pixel-perfect fake lock screens and enables lateral movement via a reverse SOCKS5 tunnel to internal services (SMB,
Analysis
TL;DR
- TWINLOOT is a modular, PyArmor-hardened Python implant that operates its entire C2 infrastructure inside trusted Microsoft services (SharePoint Online and Microsoft Teams)
- It uses SharePoint Online file dead-drops via Microsoft Graph API for tasking and WebRTC DataChannels relayed by Teams TURN servers for interactive operator access
- The implant harvests Windows credentials through pixel-perfect fake lock screens and enables lateral movement via a reverse SOCKS5 tunnel to internal services (SMB, RDP, WinRM, MSSQL)
- Initial access is achieved through social engineering on Microsoft Teams, where attackers impersonate IT support to trick targets into running a PowerShell command that downloads the payload
- This represents the first tool to combine Microsoft 365 dead drop C2, Teams TURN relay abuse, and headless browser transport under a single framework
Why It Matters
TWINLOOT demonstrates a sophisticated evolution in offensive tradecraft by completely hiding command-and-control traffic within legitimate Microsoft 365 services, making detection extremely challenging for security teams relying on traditional network monitoring. The framework's design reflects deep knowledge of Microsoft cloud architecture and represents a growing trend of threat actors abusing enterprise collaboration platforms as covert communication channels.
Technical Details
- C2 Architecture: Two parallel channels operate from the victim machine — a SharePoint dead drop that authenticates to an attacker's Azure tenant and polls for commands every 15 seconds, and a reverse SOCKS5 tunnel for interactive access and lateral movement
- Headless Browser Transport: Graph API traffic is driven through a headless instance of the victim's own Edge browser, making it virtually indistinguishable from legitimate network activity
- Credential Harvesting: The implant uses "pixel-perfect fake lock screens" triggered by the "credz_waiting" command; passwords are never validated against Windows authentication — victims see an "incorrect password" error and re-enter credentials, which are then encrypted and exfiltrated via SharePoint
- Lateral Movement: The SOCKS5 listener on the operator's machine (127.0.0.1:1080) proxies traffic into the victim's internal network, exiting from pythonw.exe to targets on ports 445 (SMB), 3389 (RDP), 5985 (WinRM), and 1433 (MSSQL)
- Initial Access & Payload: Social engineering via Microsoft Teams impersonating IT support; PowerShell command downloads an archive containing Python runtime and a 39 MB compiled payload ("bootstrap-fat.pyc") that serves as the TWINLOOT loader
- TURN Relay Implementation: Uses WebRTC DataChannels via aiortc library, differing from similar tools like Backdoor.Turn (which uses QUIC sessions) and msaRAT (which uses Twilio TURN with CDP-based browser control)
Industry Insight
- Security teams should implement enhanced monitoring for anomalous Microsoft Graph API activity and WebRTC traffic patterns originating from Edge browsers, as traditional network-based detection will likely miss this type of legitimate-service abuse
- The rapid adoption of TURN relay abuse by multiple threat actors (DragonForce, Chaos ransomware group) within a year of the "Ghost Calls" technique disclosure indicates this is becoming a standardized offensive capability that should be incorporated into threat intelligence frameworks and detection rules
- Organizations should enforce strict PowerShell execution policies and user awareness training specifically targeting Teams-based social engineering, as the initial access vector exploits trust in internal IT communication channels
Disclaimer: The above content is generated by AI and is for reference only.