TwinLoot Malware Framework Exploits Microsoft Cloud Services for Lurid Gains

A newly discovered malware framework called TwinLoot is taking the concept of 'living off the land' (LOLT) to new heights by operating its entire command-and-control (C2) from inside Microsoft Azure and 365 services.

According to researchers at Ontinue Cyber Defense Center, TwinLoot uses various Microsoft services for different purposes, making it difficult to distinguish from legitimate cloud traffic.

The framework engages in malicious activities such as harvesting Windows credentials via fake lock screens, providing a reverse SOCKS5 pivot into victim networks, executing arbitrary commands, and creating a persistent network presence.

One of the unique features of TwinLoot is its use of an offline-forged mandatory profile hive created without administrative privileges, which researchers have dubbed 'Corrupting the Hive Mind.'

This persistence technique is particularly concerning as it makes standard detection logic ineffective.