Cybersecurity researchers have uncovered a sophisticated Python-based malware framework named TWINLOOT, which leverages Microsoft services to infiltrate networks and exfiltrate sensitive data. This discovery highlights the evolving tactics of threat actors who exploit trusted platforms to evade detection.
TWINLOOT operates by embedding its command-and-control (C2) infrastructure within legitimate Microsoft services. It utilizes SharePoint Online for tasking through the Microsoft Graph API and employs Microsoft Teams’ TURN (Traversal Using Relays around NAT) servers to relay interactive access via WebRTC DataChannels. This approach allows the malware to blend seamlessly with normal network traffic, making it challenging for traditional security measures to identify malicious activities.
The malware initiates its operations by running a headless instance of the victim’s Edge browser to communicate with the Graph API. This method ensures that the traffic appears as standard user activity. TWINLOOT’s capabilities include harvesting Windows credentials through deceptive lock screens, establishing reverse SOCKS5 tunnels for network pivoting, executing arbitrary commands, and maintaining persistence on compromised hosts.
The initial infection vector is believed to be a social engineering attack conducted via Microsoft Teams. In this scenario, attackers impersonate IT support personnel to convince targets to execute a PowerShell command. This command downloads an archive containing the Python runtime and a substantial compiled payload, which serves as the loader for TWINLOOT.
Once deployed, TWINLOOT establishes two concurrent communication channels from the infected machine. The first channel involves a SharePoint dead drop that authenticates to an attacker’s Azure tenant, polling a SharePoint drive every 15 seconds for commands. This mechanism allows the attacker to issue instructions and receive exfiltrated data discreetly.
The second channel sets up a reverse SOCKS5 tunnel, facilitating interactive access and lateral movement within the network. This tunnel can operate over a direct TLS/WebSocket connection to the attacker’s server or through Teams TURN WebRTC relays. By creating a SOCKS5 listener on the attacker’s machine, the malware proxies traffic into the victim’s internal network, making it appear as though the compromised host is initiating normal connections to internal services such as SMB, RDP, WinRM, and MSSQL.
To further its reach, TWINLOOT employs a credential harvesting technique using fake lock screen prompts. When the attacker issues a specific command, the malware displays a counterfeit lock screen, prompting the user to enter their password. Regardless of the input, the screen returns an error message, likely prompting the user to re-enter the correct password. The captured credentials are then encrypted and uploaded to the SharePoint drive, enabling the attacker to use them for lateral movement within the network.
This discovery underscores the increasing sophistication of cyber threats that exploit trusted cloud services to conduct malicious activities. Organizations must enhance their security postures by implementing robust monitoring of cloud service interactions, educating employees about social engineering tactics, and deploying advanced threat detection mechanisms capable of identifying such stealthy intrusions.
