TWINLOOT Implant Abuses Microsoft Services for Stealthy C2 Communications

A new Python implant called TWINLOOT has been discovered, which uses multiple trusted Microsoft services to evade detection and hide its command-and-control (C2) communications from security tools. According to a report by Ontinue, this implant is designed to make it more challenging for organizations to block attacks by ensuring that defenders only see connections to legitimate Microsoft services and IPs rather than unknown external domains.

The attack begins with social engineering via Microsoft Teams, where an attacker impersonates IT staff and lures a victim into running a PowerShell command that downloads a malicious archive. This archive contains a Python 3.12.9 runtime and a loader called bootstrap-fat.pyc, which carries an additional embedded archive protected by PyArmor 9.2.5 Pro encryption.

The implant uses two parallel C2 channels to conduct malicious activities, each of which uses a different Microsoft service to hide its communications. The first channel is an 'always-on tasking channel' that uses a SharePoint 'dead-drop' polled every 15 seconds for commands, while the second channel is a reverse SOCKS5 tunnel that services as an 'interactive access channel' for the attacker and a path for lateral movement.