TWINLOOT runs its entire C2 inside Microsoft 365, and your egress filter will not see it

Ontinue's Cyber Defense Center says it found a previously undocumented, modular, PyArmor-hardened Python implant framework called TWINLOOT while investigating an ongoing campaign in July 2026 ^[1][2]. The point of interest is not the language but the plumbing: Ontinue describes the framework as designed to run its entire command-and-control infrastructure inside trusted Microsoft services ^[3], which removes egress filtering and domain reputation from the list of controls that would ever fire.

Tasking arrives through SharePoint Online file dead drops reached via the Microsoft Graph API ^[4]. The implant authenticates to an attacker-controlled Azure tenant and polls a SharePoint drive for commands every 15 seconds ^[5], which is 5,760 polls per day per host ^[18]. Interactive access is a separate channel: a reverse SOCKS5 tunnel running either over a direct TLS/WebSocket connection to the operator's server or through a Teams TURN WebRTC relay ^[6]. The Graph traffic is not produced by a bespoke HTTP client. It is driven by a headless instance of the victim's own Edge browser, which Ontinue says makes it virtually indistinguishable from legitimate network activity ^[7].

Initial access, on Ontinue's assessment, was social engineering over Microsoft Teams, with the actor posing as IT support to talk a target into running a PowerShell command that downloaded an archive containing a Python runtime and a 39 MB compiled loader, bootstrap-fat.pyc ^[8]. Credential theft is cruder and probably more reliable than the transport. The implant renders a pixel-perfect fake lock screen when the operator issues the "credz_waiting" command ^[9][10]. What the user types is never validated against Windows authentication; the first attempt always returns "The password is incorrect. Try again," which Ontinue assesses is meant to make the victim supply the correct password on the second try ^[11]. The captured password is encrypted and uploaded to the SharePoint drive, and the fake screen closes itself ^[12]. From there the credential is used through the tunnel to pivot by RDP or WinRM ^[13].

The host-side artifacts are where this becomes tractable. The operator's SOCKS5 listener sits on 127.0.0.1:1080 on their own machine, and the resulting sessions leave the victim from pythonw.exe toward internal 445, 3389, 5985 and 1433, so the internal network sees what looks like a compromised host making ordinary lateral connections ^[14]. That means the detectable behaviours are a Python interpreter opening SMB, RDP, WinRM and MSSQL sessions, and a browser process making Graph calls on a metronome against a tenant that is not yours ^[5][7][14]. Neither is a boundary signal, and neither is improved by a better blocklist.

TWINLOOT is not the only tool on this path. In June 2026, Broadcom-owned Symantec and Carbon Black documented DragonForce ransomware using a Go-based RAT, Backdoor.Turn, to conceal C2 inside Microsoft Teams relay infrastructure using a QUIC session through the relay, where TWINLOOT uses WebRTC DataChannels via aiortc ^[15][16]. A Rust-based RAT, msaRAT, was reported late last month using the same TURN method ^[19]. That is three families on public record abusing the same relay ^[21]. Ontinue's narrower claim is that TWINLOOT is the first to combine Microsoft 365 dead-drop C2, Teams TURN relay abuse, and headless browser transport under a single umbrella ^[17], and it describes the operator as knowledgeable in both offensive tradecraft and Microsoft cloud architecture ^[20].

Worth watching: whether defenders get usable telemetry distinguishing headless Edge launched by a script from Edge launched by a person ^[7], whether Graph authentication to non-corporate tenants becomes a routine hunt input ^[5], and whether the TURN relay count moves past three ^[21].