New Malware Uses Microsoft Services to Evade Detection

Security researchers have discovered a new malware framework called TWINLOOT that routes its command-and-control (C2) activity through Microsoft services, making it difficult to detect. Ontinue Cyber Defense Center discovered the implant in July and has since tracked it as TWINLOOT.

The malware uses SharePoint Online as a file-based dead drop, Microsoft Teams' TURN infrastructure for interactive communications, and a headless instance of the victim's own Edge browser to send Microsoft Graph API requests. This allows it to authenticate to an attacker-controlled Azure tenant rather than the victim's Microsoft 365 environment, producing no authentication or audit events in the victim's Entra ID logs.

TWINLOOT is also capable of establishing a reverse SOCKS5 tunnel and routing it through Microsoft's Teams TURN infrastructure for interactive access. This allows the operator to use the compromised endpoint to access the internal network, with connections to services such as SMB, RDP, and WinRM appearing to originate from the victim machine.