Top Highlights
- Researchers have uncovered TWINLOOT, a sophisticated, modular Python-based implant that uses Microsoft 365 services for command-and-control, blending SharePoint dead drops, Teams relay abuse, and headless browser transport.
- The malware employs multiple covert channels—SharePoint API, SOCKS5 tunneling via WebRTC relays, and victim’s Edge browser—to stealthily execute commands, exfiltrate data, and facilitate lateral movement within networks.
- TWINLOOT captures Windows credentials through fake lock screens, encrypts and uploads them to SharePoint, and then exploits these credentials for further internal access, mimicking legitimate network activity.
- The framework’s multi-method persistence techniques—including registry hive manipulation and task cache modification—highlight a level of sophistication comparable to advanced threat groups, with indicators linking it to known campaigns like STAC4749.
Cybercriminals Exploit Microsoft Services to Steal Credentials
Recent investigations reveal that malicious hackers are abusing trusted Microsoft tools like SharePoint Online and Teams to carry out their attacks. They use a sophisticated Python-based implant called TWINLOOT, which is designed to operate stealthily within Microsoft’s cloud services. This malware communicates with attackers using multiple channels, making it hard to detect. For example, it uses SharePoint to send and receive commands every 15 seconds. Additionally, it relays interactive access through Microsoft Teams’ relay servers.
The initial trick to infect a victim begins with social engineering. The attackers pretend to be IT support on Microsoft Teams and persuade the target to run a PowerShell command. This command downloads TWINLOOT’s loader, a small file that starts the malicious program. Once active, TWINLOOT can harvest Windows passwords using fake lock screens, which tricks users into providing their credentials. The malware then encrypts and uploads these passwords to SharePoint, where it can access and exploit them later. This combination of tools and methods allows cybercriminals to move freely across internal networks without raising suspicion.
Multiple Channels Enable Stealthy Network Movement
TWINLOOT uses two main ways to navigate through a compromised network. First, it establishes a connection to a command-and-control server via SharePoint. This allows the attacker to send instructions and receive stolen data quietly. Second, it sets up a reverse SOCKS5 proxy, which creates a tunnel from the victim’s machine to the attacker’s network. This tunnel can route internal traffic, such as RDP or SMB connections, through the compromised host.
This clever technique makes internal network activity seem normal to security systems. When a victim inputs a password on a fake lock screen, the malware captures it and uses the encrypted version to later access other computers or servers. Researchers warn that this approach, combining browser-driven transport with cloud relays, shows an increased level of sophistication among cybercriminals. The use of trusted Microsoft services as covert channels highlights the importance of vigilant cybersecurity practices in today’s digital world.
Discover More Technology Insights
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Discover archived knowledge and digital history on the Internet Archive.
CyberAttacks-V1
