TWINLOOT: Microsoft 365 Weaponized as C2 Platform for Enterprise-Native Implants

TWINLOOT is a Python-based enterprise-native implant that weaponizes Microsoft 365 services for command-and-control. Attackers use external Microsoft Teams tenant messaging to impersonate IT support and deliver a PowerShell execution chain. The implant leverages SharePoint dead-drops for C2 and exfiltration, abuses Teams TURN relays, and controls headless Microsoft Edge via Chrome DevTools Protocol to blend traffic with legitimate browser activity. It harvests credentials via fake Windows lock-screen prompts and enables lateral movement through an integrated SOCKS5 proxy. Observed across at least three independent threat actors, this TTP cluster bypasses perimeter controls by routing malicious traffic through trusted M365 infrastructure.

• Threat Campaign: Enterprise-Native C2 Shift

  • TWINLOOT is a Python implant weaponizing Microsoft 365 services for C2.
  • At least three independent threat actors observed using these TTPs in the past year.
  • Malicious traffic blends with legitimate M365 activity to bypass perimeter controls.

• Initial Access: Teams Social Engineering

  • Attackers use external Teams tenant messaging to impersonate IT support.
  • Ontinue data: 30% of organizations faced fake IT support impersonation on Teams.
  • PowerShell execution chain delivers the Python implant after user interaction.

• C2 Mechanics: SharePoint, TURN, and CDP

  • SharePoint dead-drops host commands and exfiltrated data.
  • Microsoft Teams TURN relays abused for covert C2 communication.
  • Headless Microsoft Edge controlled via Chrome DevTools Protocol mimics browser traffic.

• Credential Theft and Lateral Movement

  • Fake Windows lock-screen prompts capture enterprise credentials.
  • Integrated SOCKS5 proxy enables internal network lateral movement.
  • Microsoft Graph API and Azure AD app permissions abused for access and persistence.

• Detection and Mitigation

  • Monitor anomalous SharePoint access and Teams TURN relay flows.
  • Audit Azure AD app consent and Microsoft Graph API permissions.
  • Enforce phishing-resistant MFA; restrict external Teams tenant messaging.
  • Detect headless Edge processes and unauthorized CDP socket connections.