TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Researchers have revealed a previously unknown Python implant framework called TWINLOOT, which is designed to operate within trusted Microsoft services. TWINLOOT is a modular framework that has been hardened with PyArmor, allowing it to evade detection. The framework uses Microsoft services, including SharePoint Online, as part of its command-and-control infrastructure. This enables TWINLOOT to steal credentials and move across networks, with tasking flows going through SharePoint Online files. TWINLOOT's use of trusted services is a key aspect of its ability to operate undetected. The framework's capabilities have been detailed in a technical report by Ontinue.