SURIQ
Every detection program carries one assumption it rarely states out loud: that an attacker's command channel eventually reaches somewhere unfamiliar. A domain nobody has seen, an address with a bad reputation, a certificate that does not belong. Block the strange destinations and you strangle the command channel. A Python framework that Ontinue's Cyber Defense Center took apart this month, which it calls TWINLOOT, is built to make that assumption fail. Every hop it makes ends on a Microsoft endpoint your firewall already trusts.
That is the entire design. TWINLOOT does not smuggle traffic past your controls. It walks through the front door your allowlist holds open for SharePoint, Teams, and Edge. There is no CVE, no exploit, and nothing to patch. The malware abuses services that are working exactly as intended.
Four legs, all of them Microsoft
Ontinue found TWINLOOT while investigating a live intrusion in July. The initial foothold is old-fashioned: a Teams message from someone posing as IT support talks the target into running a PowerShell command that pulls down a bootstrap payload, a compiled Python file of roughly 39 MB. What happens after that is the part worth studying.
The implant splits its command channel across services defenders are trained to ignore:
- Tasking arrives through a SharePoint Online dead drop. The implant polls a file about every fifteen seconds over the Microsoft Graph API, reads its orders, and writes results and stolen data back to the same place.
- Those Graph calls do not come from a suspicious script. TWINLOOT launches the victim's own Edge browser in headless mode, attaches to it through the Chrome DevTools Protocol, and issues the API requests as same-origin fetches from inside the browser. On the wire it looks like Edge talking to Microsoft, because it is.
- For interactive access, the operator rides a reverse SOCKS5 tunnel routed through Microsoft Teams TURN relays over WebRTC data channels. Ontinue describes this as the first implant it has seen using genuine WebRTC data channels for the technique.
- The quietest choice is the one that is easiest to miss. It signs in to an Azure tenant the attacker owns, not the one you run, so none of this activity leaves a sign-in or audit record in your own Entra ID logs.
Sit with that last point, because it inverts where most teams look first. When something feels wrong in a cloud environment, the identity plane is the reflex: check the sign-in logs, check the audit trail. Here that plane stays blank by design. The traffic is real Microsoft traffic, but the account behind it lives in a tenant you do not own and cannot see.
The password prompt is the payload
Credential theft uses no exploit either. On command, TWINLOOT paints a pixel-perfect Windows lock screen over the session and waits. The user, seeing what looks like a routine session timeout, types their password. The malware never checks whether it is correct. It captures every attempt, encrypts it, and ships it out through the SharePoint channel.
This is worth reframing for anyone who runs security awareness. An unexpected lock screen or re-authentication prompt, appearing when no normal sign-in is underway, usually gets filed under minor annoyance. Against this technique it is a first-order indicator. The same trick that fools a hurried user is the one you can train that user to report.
Once it holds credentials and a foothold, TWINLOOT opens the reverse SOCKS5 pivot and reaches for the internal services that matter: SMB, RDP, WinRM, and SQL Server. To your network sensors those connections originate from a legitimate corporate endpoint, because they do.
A new place to hide, no admin required
Persistence follows the same signature-free logic. The method Ontinue highlights, which it nicknames corrupting the hive mind, creates an offline Windows mandatory-profile registry hive, an NTUSER.MAN file, rather than editing the live registry. It needs no administrator rights and generates no registry-modification event for a monitoring tool to catch. Ontinue reports this as the first time the method has appeared in the wild. The framework carries other options as well, from COM type-library hijacking to a scheduled-task trick and even an unused Ethereum-based fallback for retrieving its next stage, which suggests the tooling is still under active development.
Ontinue found overlaps with a cluster it tracks as STAC4749, including the Teams lure and the reverse SOCKS5 design, but the underlying code differs enough that it stopped short of naming an operator. Treat the attribution as unsettled and the technique as the story.
Why this is not one clever tool
TWINLOOT reads less like a novelty and more like a convergence. We have watched the individual moves before. DragonForce hid its command channel inside Microsoft Teams TURN relays, so network sensors saw only a clean call to Microsoft. A separate implant, HollowGraph, ran its C2 through a hijacked Microsoft 365 calendar over the Graph API. TWINLOOT takes both ideas, adds the browser as a proxy and the attacker-owned tenant as a blind spot, and folds the whole thing into one framework. Living off trusted cloud services has graduated from a bespoke trick into a reusable kit.
That shift changes how you defend. A program organized around patching and known-bad indicators has almost nothing to bite here. There is no vulnerable version, no malicious domain, no signature. The controls that actually apply are the ones many teams underfund: governance over which applications and tenants can obtain tokens against your data, and behavioral baselines on the endpoint itself.
What to watch when the network looks clean
Detection moves off the wire and onto behavior. Ontinue and the reporting around it point at a handful of signals worth building into your hunting:
- Edge, or any Chromium browser, running in headless mode with the DevTools debugging port open, especially when a Python process spawned it rather than a user.
- A Python interpreter such as pythonw.exe making outbound Graph API calls, or opening internal connections to SMB, RDP, WinRM, or SQL Server.
- SharePoint or Graph access that polls on a tight, machine-regular cadence, roughly every fifteen seconds, rather than the bursty rhythm of a person.
- Creation of NTUSER.MAN files in user profile directories, which few legitimate deployments produce.
- User reports of unexpected lock screens or password prompts. Make that a reportable event, not a shrug.
Because the identity evidence is missing from your own tenant, this is one of the cases where the endpoint tells the truth the cloud logs will not. It also argues, again, for tightening application-consent and token governance across your Microsoft estate. We made the same point when device-code phishing surged: the account, not the exploit, is the modern way in. TWINLOOT is what an attacker does once already inside, using your most trusted services to stay there.