Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed **TWINLOOT**.  "**TWINLOOT** is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted **Microsoft** services," **Ontinue** said in a technical report. "Tasking flows through **SharePoint Online** file dead-drops via the **Microsoft Graph API**. Interactive operator access routes through **WebRTC DataChannels** relayed by **Microsoft Teams** [**TURN**](https://learn.microsoft.com/en-us/openspecs/office_protocols/ms-turn/bf1e2a02-4f6e-4975-b83c-74018546b387) servers." Traffic to and from the **Graph API** is driven by means of a headless instance of the victim's own **Edge** browser, thereby making it virtually indistinguishable from legitimate network activity. The implant is equipped to harvest **Windows** credentials using pixel-perfect fake lock screens, offer a reverse **SOCKS5** pivot into victim networks, execute arbitrary commands, and establish persistence on the host. **Ontinue**'s Cyber Defense Center said it discovered the implant during its investigation into an ongoing campaign in July 2026. A defining aspect of the malware is its use of multiple command-and-control (C2) channels, all of which make use of **Microsoft** services: * **SharePoint Online** (**Graph API**) for tasking * **Teams TURN** relays for interactive access * Victim's **Edge** browser for ferrying **Graph** traffic ## Initial Access and C2 Architecture The initial access vector is assessed to be a social engineering attack via **Microsoft Teams**, in which the threat actor masquerading as IT support persuaded a target to run a **PowerShell** command. This command is responsible for downloading an archive file containing the Python runtime and a 39 MB compiled payload ("bootstrap-fat.pyc"), which serves as a loader for **TWINLOOT**. Describing the threat actor as knowledgeable in offensive tradecraft and **Microsoft**'s cloud architecture, **Ontinue** said the Python framework is the first such tool to combine **Microsoft 365** dead drop C2, **Teams TURN** relay abuse, and headless browser transport under a single umbrella. **TWINLOOT** runs two parallel channels from the victim machine. One is a **SharePoint** dead drop that authenticates to an attacker's **Azure** tenant and polls a **SharePoint** drive for commands every 15 seconds, allowing the operator to receive instructions, run them, and exfiltrate data back to the server. The second channel makes use of a reverse **SOCKS5** tunnel to enable interactive access and lateral movement. "It runs over either a direct **TLS/WebSocket** connection to the attacker's server or through the **Teams TURN WebRTC** relay," **Ontinue** said. "The operator gets a **SOCKS5** listener on their own machine (127.0.0.1:1080), and proxies traffic through it into the victim's internal network. Those connections exit from `pythonw.exe` on the victim host to internal targets on ports like 445 (**SMB**), 3389 (**RDP**), 5985 (**WinRM**), and 1433 (**MSSQL**). To the victim's internal network, it looks like the compromised host is making normal lateral connections."  ## Credential Harvesting and Lateral Movement To enable lateral movement, the operator captures the victim's password via bogus lock screen prompts and exfiltrates it over the **SharePoint** channel. The fake screen is rendered when the "`credz_waiting`" command is issued by the threat actor. It's worth noting that the entered password is not validated against **Windows** authentication to check if the victim has entered the right system password. Regardless of what is provided, the victim is displayed an error message "The password is incorrect. Try again," likely causing them to input the correct password the second time. Once the credential is entered, the fake lock screen is automatically closed. Every password captured by the screen is encrypted and uploaded to the **SharePoint** drive. These credentials are then abused through the **SOCKS5** tunnel to pivot to the next host using **Remote Desktop Protocol (RDP)** or **WinRM**. ## The Rise of TURN Relay Abuse This is not the first time bad actors have leveraged a **TURN**-based mechanism to communicate with the threat actor. In June 2026, **Broadcom**-owned **Symantec** and **Carbon Black** detailed **DragonForce** ransomware's use of a Go-based remote access trojan (**RAT**) called [**Backdoor.Turn**](https://thehackernews.com/2026/06/dragonforce-hackers-abuse-microsoft.html) to conceal command-and-control (**C2**) traffic inside **Microsoft Teams** relay infrastructure. Although the overall modus operandi is the same, the manner in which they are implemented is different in both tools: **Backdoor.Turn** uses a **QUIC** session through the relay. **TWINLOOT**, on the other hand, uses **WebRTC DataChannels** via **aiortc**. Then, late last month, another new Rust-based **RAT** dubbed [**msaRAT**](https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/) was observed using the same **TURN** method, but against **Twilio** instead of **Teams**. Attributed to the [**Chaos ransomware group**](https://thehackernews.com/2025/07/chaos-raas-emerges-after-blacksuit.html), the malware is implemented using the **Tokio** asynchronous runtime to control a headless browser session and establish a covert tunnel to the attacker's server. The **DLL** malware ("lib.dll") is launched prior to the deployment of the ransomware by means of an **MSI** installer that's downloaded from an external host. It then locates the **Chrome** or **Edge** installation path, launches the browser in headless mode, and injects **JavaScript** code into a new browser tab to initialize a **WebRTC** communication channel with the C2 server. "This **RAT** never touches the network directly — it controls its C2 communication channel exclusively through **Chrome DevTools Protocol (CDP)**, a browser debugging **API**," **Cisco Talos** noted late last month. "The binary contains a **Cloudflare Workers** endpoint, but it never makes **HTTP** connections to that domain itself; it offloads that work entirely to the browser." "**msaRAT** manipulates the browser via **CDP**, performs signaling (**SDP Offer/Answer** exchange) with **Cloudflare Workers**, and establishes a **WebRTC DataChannel** between the browser and the C2 server using **Twilio TURN (Traversal Using Relays around NAT)** as a relay." The latest findings from **Ontinue** indicate how multiple threat actors have independently adopted the same **TURN** relay abuse within a year of the technique, codenamed [**Ghost Calls**](https://thehackernews.com/2025/08/weekly-recap-badcam-attack-winrar-0-day.html#:~:text=Praetorian%20Releases%20ChromeAlone), being publicly disclosed by **Praetorian**. Like in the case of **msaRAT**, **TWINLOOT** launches the victim's **Edge** browser in headless mode, enables its remote debugging interface, and connects to it via **CDP**. Once this step is complete, it navigates a browser tab to "`graph.microsoft[.]com`" and then leverages the **Drive API** to interact with the threat actor's **SharePoint**. "**Chaos group**'s **msaRAT** uses the same headless-browser-via-**CDP** architecture, but for **WebRTC** signalling through **Cloudflare Workers**," **Ontinue** explained. "The convergence is notable: two unrelated actors independently arrived at 'drive the victim's own browser as a C2 transport' within the same month." ## Advanced Persistence Mechanisms Persistence is set up based on the build (`PERSIST_ENABLED=True` or `False`). It uses four methods: * **TypeLib COM** scriptlet hijack * **GhostTask**-style **TaskCache** manipulation * Self-update using a `reobf.json` manifest The fourth method makes use of an open-source tool [**Swarmer**](https://github.com/praetorian-inc/swarmer), which was released by [**Praetorian**](https://www.praetorian.com/blog/corrupting-the-hive-mind-persistence-through-forgotten-windows-internals/) last year as a way to "convert **Windows Registry** export files into **Windows** hive files that can be used to replace `NTUSER.MAN`." The method makes it possible to create stealthy **Registry** keys to `HKEY_CURRENT_USER` (aka **HKCU**) without being detected by security software even in the absence of administrator access. "The implant builds a mandatory **Windows** profile hive entirely offline using two **APIs**: `RegLoadAppKeyW` (which loads a registry hive into a private application namespace without requiring admin privileges) and **Microsoft**'s offline registry library `offreg.dll` (**ORCreateKey**, **ORSetValue**, **ORSaveHive**)," **Ontinue** said. "The resulting hive is written to `%USERPROFILE%\NTUSER.MAN`. When **Windows** loads a user profile, it checks for `NTUSER.MAN` (a mandatory profile override) before `NTUSER.DAT`. If `NTUSER.MAN` exists, its contents take precedence."