TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

A previously undocumented Python implant framework dubbed TWINLOOT has been disclosed by cybersecurity researchers. The framework, designed to operate its entire command-and-control infrastructure inside trusted Microsoft services, abuses SharePoint and Teams to steal credentials and move across networks.

The implant is a modular, PyArmor-hardened Python framework designed to operate its entire command-and-control infrastructure inside trusted Microsoft services. It uses multiple command-and-control (C2) channels, all of which make use of Microsoft services:

- SharePoint Online (Graph API) for tasking - Teams TURN relays for interactive access - Victim's Edge browser for ferrying Graph traffic

The initial access vector is assessed to be a social engineering attack via Microsoft Teams, in which the threat actor masquerading as IT support persuaded a target to run a PowerShell command that's responsible for downloading an archive file containing the Python runtime and a 39 MB compiled payload ("bootstrap-fat.pyc"), which serves as a loader for TWINLOOT.

## TWINLOOT's Capabilities

TWINLOOT runs two parallel channels from the victim machine: One is a SharePoint dead drop that authenticates to an attacker's Azure tenant and polls a SharePoint drive for commands every 15 seconds, allowing the operator to receive instructions, run them, and exfiltrate data back to the server.

The second channel makes use of a reverse SOCKS5 tunnel to enable interactive access and lateral movement. "It runs over either a direct TLS/WebSocket connection to the attacker's server or through the Teams TURN WebRTC relay," Ontinue said.

The operator gets a SOCKS5 listener on their own machine (127.0.0.1:1080), and proxies traffic through it into the victim's internal network. Those connections exit from pythonw.exe on the victim host to internal targets on ports like 445 (SMB), 3389 (RDP), 5985 (WinRM), and 1433 (MSSQL). To the victim's internal network, it looks like the compromised host is making normal lateral connections.

## Persistence and Lateral Movement

To enable lateral movement, the operator captures the victim's password via bogus lock screen prompts and exfiltrates it over the SharePoint channel. The fake screen is rendered when the "credz_waiting" command is issued by the threat actor.

Once the credential is entered, the fake lock screen is automatically closed. Every password captured by the screen is encrypted and uploaded to the SharePoint drive. These credentials are then abused through the SOCKS5 tunnel to pivot to the next host using Remote Desktop Protocol (RDP) or WinRM.

## Comparison with Other Malware

This is not the first time bad actors have leveraged a TURN-based mechanism to communicate with the threat actor. In June 2026, Broadcom-owned Symantec and Carbon Black detailed DragonForce ransomware's use of a Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure.

Although the overall modus operandi is the same, the manner in which they are implemented is different in both tools: Backdoor.Turn uses a QUIC session through the relay. TWINLOOT, on the other hand, uses WebRTC DataChannels via aiortc.

## Persistence Methods

The implant builds a mandatory Windows profile hive entirely offline using two APIs: RegLoadAppKeyW (which loads a registry hive into a private application namespace without requiring admin privileges) and Microsoft's offline registry library offreg.dll (ORCreateKey, ORSetValue, ORSaveHive).

The resulting hive is written to %USERPROFILE% \NTUSER.MAN. When Windows loads a user profile, it checks for NTUSER.MAN (a mandatory profile override) before NTUSER.DAT. If NTUSER.MAN exists, its contents take precedence.

## Development and Operational Parallels

It's not clear who is behind the toolkit, but Ontinue said it shares operational parallels with a cluster called STAC4749, which has a track record of orchestrating Teams voice phishing campaigns to deploy Chaos ransomware.

"The STAC4749 overlaps are notable, Teams vishing delivery, a PyArmour-obfuscation python backdoor, a reverse SOCKS5 proxy, HKCU Run Key persistence, and an adjacent timeline," the cybersecurity company said. "However, the underlying implementation differs substantially."

| Feature | TWINLOOT | STAC4749 | | --- | --- | --- | | C2 Channels | SharePoint Online (Graph API), Teams TURN relays, Victim's Edge browser | PyInstaller, Go-Based implants, standalone SOCKS5 proxy tooling | | Persistence | TypeLib COM scriptlet hijack, GhostTask-style TaskCache manipulation, Self-update using a reobf.json manifest, Windows profile hive manipulation | HKCU Run Key persistence | | Obfuscation | PyArmor | PyArmour | | Domains | Drop-caught aged domains with SharePoint dead-drop C2 | .top domains behind Cloudflare |