TWINLOOT Routes C2 Through SharePoint Graph API and Teams TURN Servers Using Victim Edge Instance

The implant was identified by Ontinue during a July 2026 investigation after initial access via Teams social engineering that delivered a 39 MB bootstrap-fat.pyc loader. Tasking occurs through attacker-controlled SharePoint drives in their Azure tenant while interactive access routes through TURN servers, producing traffic indistinguishable from legitimate Microsoft 365 sessions. Credential capture relies on pixel-perfect lock screen overlays triggered by the credz_waiting command, with harvested passwords encrypted and uploaded without local validation.

Evidence consists of observed Graph API polling intervals, WebRTC DataChannel usage for reverse SOCKS5 listeners on 127.0.0.1:1080, and lateral movement attempts targeting ports 445, 3389, 5985, and 1433 from pythonw.exe. This matches patterns in prior TURN abuse documented by Symantec in DragonForce ransomware operations from June 2026. No independent technical attribution to a named actor exists beyond Ontinue's assessment of advanced Microsoft cloud knowledge.

The framework demonstrates operational maturity by combining dead-drop C2, browser transport, and native credential prompts in a single package. Defenders monitoring only perimeter controls will miss the activity since all external channels originate from trusted Microsoft endpoints. Internal network logs showing unusual pythonw.exe connections to SMB and RDP targets remain the strongest detection signal.

Microsoft is expected to release updated Graph API logging requirements and Teams TURN relay restrictions within 90 days. Organizations should baseline headless Edge instances and enforce application control policies blocking unsigned Python loaders to limit similar implants.