Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT.
"TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file dead-drops via the Microsoft Graph API. Interactive operator access routes through WebRTC DataChannels relayed by Microsoft Teams TURN servers."
Traffic to and from the Graph API is driven by means of a headless instance of the victim's own Edge browser, thereby making it virtually indistinguishable from legitimate network activity. The implant is equipped to harvest Windows credentials using pixel-perfect fake lock screens, offer a reverse SOCKS5 pivot into victim networks, execute arbitrary commands, and establish persistence on the host.
Ontinue's Cyber Defense Center said it discovered the implant during its investigation into an ongoing campaign in July 2026. A defining aspect of the malware is its use of multiple command-and-control (C2) channels, all of which make use of Microsoft services -
- SharePoint Online (Graph API) for tasking
- Teams TURN relays for interactive access
- Victim's Edge browser for ferrying Graph traffic
The initial access vector is assessed to be a social engineering attack via Microsoft Teams, in which the threat actor masquerading as IT support persuaded a target to run a PowerShell command that's responsible for downloading an archive file containing the Python runtime and a 39 MB compiled payload ("bootstrap-fat.pyc"), which serves as a loader for TWINLOOT.
Describing the threat actor as knowledgeable in offensive tradecraft and Microsoft's cloud architecture, Ontinue said the Python framework is the first such tool to combine Microsoft 365 dead drop C2, Teams TURN relay abuse, and headless browser transport under a single umbrella.
TWINLOOT runs two parallel channels from the victim machine: One is a SharePoint dead drop that authenticates to an attacker's Azure tenant and polls a SharePoint drive for commands every 15 seconds, allowing the operator to receive instructions, run them, and exfiltrate data back to the server.
The second channel makes use of a reverse SOCKS5 tunnel to enable interactive access and lateral movement. "It runs over either a direct TLS/WebSocket connection to the attacker's server or through the Teams TURN WebRTC relay," Ontinue said.
"The operator gets a SOCKS5 listener on their own machine (127.0.0.1:1080), and proxies traffic through it into the victim's internal network. Those connections exit from pythonw.exe on the victim host to internal targets on ports like 445 (SMB), 3389 (RDP), 5985 (WinRM), and 1433 (MSSQL). To the victim's internal network, it looks like the compromised host is making normal lateral connections."
To enable lateral movement, the operator captures the victim's password via bogus lock screen prompts and exfiltrates it over the SharePoint channel. The fake screen is rendered when the "credz_waiting" command is issued by the threat actor.
It's worth noting that the entered password is not validated against Windows authentication to check if the victim has entered the right system password. Regardless of what is provided, the victim is displayed an error message "The password is
incorrect. Try again," likely causing them to input the correct password the second time.
Once the credential is entered, the fake lock screen is automatically closed. Every password captured by the screen is encrypted and uploaded to the SharePoint drive. These credentials are then abused through the SOCKS5 tunnel to pivot to the next host using Remote Desktop Protocol (RDP) or WinRM.
This is not the first time bad actors have leveraged a TURN-based mechanism to communicate with the threat actor. In June 2026, Broadcom-owned Symantec and Carbon Black detailed DragonForce ransomware's use of a Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure.
Although the overall modus operandi is the same, the manner in which they are implemented is different in both tools: Backdoor.Turn uses a QUIC session through the relay. TWINLOOT, on the other hand, uses WebRTC DataChannels via aiortc.
Then, late last month, another new Rust-based RAT dubbed msaRAT was observed using the same TURN method, but against Twilio instead of Teams. Attributed to the Chaos ransomware group, the malware is implemented using the Tokio asynchronous runtime to control a headless browser session and establish a covert tunnel to the attacker's server.
The DLL malware ("lib.dll") is launched prior to the deployment of the ransomware by means of an MSI installer that's downloaded from an external host. It then locates the Chrome or Edge installation path, launches the browser in headless mode, and injects JavaScript code into a new browser tab to initialize a WebRTC communication channel with the C2 server.
"This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API," Cisco Talos noted late last month. "The binary contains a Cloudflare Workers endpoint, but it never makes HTTP connections to that domain itself; it offloads that work entirely to the browser."
"msaRAT manipulates the browser via CDP, performs signaling (SDP Offer/Answer exchange) with Cloudflare Workers, and establishes a WebRTC DataChannel between the browser and the C2 server using Twilio TURN (Traversal Using Relays around NAT) as a relay."
The latest findings from Ontinue indicate how multiple threat actors have independently adopted the same TURN relay abuse within a year of the technique, codenamed Ghost Calls, being publicly disclosed by Praetorian.
Like in the case of msaRAT, TWINLOOT launches the victim's Edge browser in headless mode, enables its remote debugging interface, and connects to it via CDP. Once this step is complete, it navigates a browser tab to "graph.microsoft[.]com" and then leverages the Drive API to interact with the threat actor's SharePoint.
"Chaos group's msaRAT uses the same headless-browser-via-CDP architecture, but for WebRTC signalling through Cloudflare Workers," Ontinue explained. "The convergence is notable: two unrelated actors independently arrived at 'drive the victim's own browser as a C2 transport' within the same month."
Persistence is set up based on the build (PERSIST_ENABLED=True or False). It uses four methods -
- TypeLib COM scriptlet hijack
- GhostTask-style TaskCache manipulation
- Self-update using a reobf.json manifest
The fourth method makes use of an open-source tool Swarmer, which was released by Praetorian last year as a way to "convert Windows Registry export files into Windows hive files that can be used to replace NTUSER.MAN." The method makes it possible to create stealthy Registry keys to HKEY_CURRENT_USER (aka HKCU) without being detected by security software even in the absence of administrator access.
"The implant builds a mandatory Windows profile hive entirely offline using two APIs: RegLoadAppKeyW (which loads a registry hive into a private application namespace without requiring admin privileges) and Microsoft's offline registry library offreg.dll (ORCreateKey, ORSetValue, ORSaveHive)," Ontinue said.
"The resulting hive is written to %USERPROFILE% \NTUSER.MAN. When Windows loads a user profile, it checks for NTUSER.MAN (a mandatory profile override) before NTUSER.DAT. If NTUSER.MAN exists, its contents take precedence."
The development marks the first recorded malicious use of this persistence method in the wild. Beyond these capabilities, TWINLOOT supports reconnaissance, discovery, screenshot capture, and the ability to fall back to an EtherHiding-style mechanism to obtain the runtime configuration if the Azure Blob Storage dead drop method fails. The Ethereum-based resolution is unused in the build, suggesting the framework is being actively developed.
It's not clear who is behind the toolkit, but Ontinue said it shares operational parallels with a cluster called STAC4749, which has a track record of orchestrating Teams voice phishing campaigns to deploy Chaos ransomware.
"The STAC4749 overlaps are notable, Teams vishing delivery, a PyArmour-obfuscation python backdoor, a reverse SOCKS5 proxy, HKCU Run Key persistence, and an adjacent timeline," the cybersecurity company said. "However, the underlying implementation differs substantially."
"STAC4749 uses PyInstaller, packaging, Go-Based implants, standalone SOCKS5 proxy tooling, and .top domains behind Cloudflare. TWINLOOT uses raw .pyc execution, pure Python, an integrated SOCKS5 multiplexer, and drop-caught aged domains with SharePoint dead-drop C2. If these are the same operator, the tooling was rebuilt from scratch rather than evolved."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.