TWINLOOT: An Implant That Lives Inside Microsoft’s Cloud

By Geist | August 19, 2026

The Ontinue Cyber Defense Center has disclosed a Python-based implant framework that hides its command channel inside SharePoint, tunnels interactive access through Microsoft Teams, and routes every API request through their own Edge browser. The framework is the first of its kind, and the first in-the-wild use of a persistence technique that needs no admin rights and produces no registry events.

Why this deserves today’s attention

There is a class of malware that gets discovered on a Tuesday, written up on a Wednesday, and forgotten by Friday. TWINLOOT is not that class. It is the first observed framework to combine three operational primitives that defenders have historically treated as separate problems: command tasking inside a Microsoft 365 dead drop, interactive access over Microsoft Teams TURN relay infrastructure, and Graph API traffic driven through their own headless Edge browser. The combination turns Microsoft’s productivity stack into a command and control infrastructure that domain reputation, IP blocking, and process name heuristics are structurally blind to. The persistence technique is a separate first in the wild. There has been no public indicator set, no victim count, and no named actor. The framework is enough on its own.

Executive summary in plain English

In July 2026, the security firm Ontinue, while investigating an active incident, recovered a Python-based implant framework running on a Windows endpoint inside an enterprise tenant. The implant is built to look like ordinary Microsoft 365 work. Its command instructions live in a SharePoint file in an attacker controlled Azure tenant. Its interactive control channel is hidden inside Microsoft Teams media relay infrastructure. The Microsoft Graph API calls it makes are issued from inside a headless copy of their own Edge browser, so the network traffic terminates at Microsoft domains and originates from a process the host already trusts. The implant harvests Windows credentials using pixel-accurate fake lock screens, opens a reverse SOCKS5 tunnel for lateral movement, and persists on the host through four separate mechanisms, one of which is a published but never-before-observed technique that creates a Windows mandatory user profile offline. The combination of these primitives is new. The implant is called TWINLOOT. It is the first framework Ontinue has documented that combines Microsoft 365 dead drop command, Teams TURN relay abuse, and headless browser transport in a single piece of offensive software.

Discovery timeline and the organisations involved

Ontinue’s Cyber Defense Center, a managed detection and response team that has been tracking offensive tradecraft for several years, discovered TWINLOOT during the investigation of an active campaign in July 2026. The firm declined to name the affected customer or the sector. The malware was named after the SharePoint folder the operator used as the dead drop, internally tracked as TwinLoot. Ontinue waited for the active incident to be contained before publishing, and released a full technical write-up on August 18, 2026, through its own research blog. Coverage followed the same day from The Hacker News, SC Media, CSO Online, SecurityWeek, and a number of secondary outlets.

A few details matter. The SharePoint dead drop sits in an Azure tenant that is not the affected organisation\u2019s, which means no authentication or audit event shows up in the affected user\u2019s Entra ID logs. The headless Edge instance is launched by the implant itself, so its first parent process is pythonw.exe running under the user’s profile, not the user’s actual browser. The PyArmor 9.2.5 Pro encryption on the modules was sufficient to defeat standard dynamic analysis, but not sufficient to defeat Ontinue’s offline recovery using a static unpacker, which is how the firm recovered 115 of the roughly 120 modules for analysis.

The affected surface

TWINLOOT targets Windows endpoints in Microsoft 365 tenants. There is no server component. The implant is a Python 3.12.9 runtime bundled with a 39 MB compiled loader, distributed as a single archive. The persistence path, the dead drop path, and the interactive path all rely on Microsoft services the organisation has already paid for and trusts. Specifically:

Microsoft SharePoint Online is used for command tasking, through the Microsoft Graph API. The endpoint polls a SharePoint drive in the operator’s Azure tenant every fifteen seconds. The traffic looks like normal Microsoft 365 sync behaviour to anyone watching the network.

Microsoft Teams TURN servers are used for interactive access. TURN stands for Traversal Using Relays around NAT, the relay infrastructure Microsoft already uses to push voice and video through firewalls. The implant uses a custom Python port of the Praetorian TURNt toolkit, originally disclosed in 2025, to wrap a reverse SOCKS5 tunnel inside WebRTC DataChannel traffic relayed by Microsoft Teams. The connection then appears to be Teams media traffic at every point along the network path.

Microsoft Edge, in headless mode, is used to ferry Graph API calls. The implant launches a new Edge process with the Chrome DevTools Protocol enabled, attaches to it over a local WebSocket, opens a tab on graph.microsoft.com, and issues the same Graph API calls it would otherwise have made directly. From the host’s perspective, the network traffic originates from msedge.exe and terminates at Microsoft domains. The Python process never makes a Graph call itself.

The persistence is Windows only. The four persistence mechanisms include a scheduled task, a TypeLib COM scriplet hijack, a TaskCache manipulation, and the most novel of the four, a technique Ontinue calls Corrupting the Hive Mind. The Hive Mind technique uses the Windows API RegLoadAppKeyW and the off-line registry library offreg.dll to forge a mandatory user profile hive (NTUSER.MAN) without any registry write events and without administrative rights. The forged hive is written to the user’s profile directory and, because Windows treats NTUSER.MAN as a mandatory profile, it overrides the user’s normal profile on the next logon, ensuring the implant survives a logout, a reboot, or an attempt to clean the registry manually.

The vulnerability class and underlying technical failure

TWINLOOT is not, strictly, a vulnerability. It is an architecture that uses the absence of a defensive control as its attack surface. Three controls are missing.

First, there is no control on the legitimate use of Microsoft Graph API by msedge.exe. The browser process is signed by Microsoft, runs from a trusted path, and terminates at Microsoft domains. Endpoint detection rules that look for Python or PowerShell processes issuing Graph API calls do not fire, because the Graph API call is not coming from those processes.

Second, there is no control on the legitimate use of Microsoft Teams TURN infrastructure. Enterprise network egress rules typically allow Microsoft 365 traffic through. Encrypted Teams media traffic is rarely inspected. There is no signature available for the TURNt toolkit’s WebRTC DataChannel abuse that an enterprise network sensor can recognise, because the traffic is real Teams media traffic.

Third, there is no Windows control on the offline creation of a mandatory user profile. The offreg.dll and RegLoadAppKeyW APIs are legitimate Windows internals. The hive is built and written to disk without producing a single registry event. A defender looking for persistence indicators in Sysmon, in the Windows Security Event Log, or in the registry transaction log will see nothing.

The underlying technical failure is that the defensive industry has spent the last fifteen years investing in the detection of known bads. Domain reputation, IP reputation, process names, file hashes, registry event IDs. The defensive industry has spent far less on the detection of structurally permitted behaviours performed by trusted software running on trusted infrastructure. TWINLOOT is the natural outcome.

Attack chain reconstruction

The chain, as reconstructed by Ontinue from the recovered modules, has eight phases. The detail level below is what the report supports. Where the report is silent, I will say so rather than guess.

Initial access is assessed as social engineering over Microsoft Teams. The operator, posing as internal IT support, contacts a target and convinces them to run a PowerShell command. The exact pretext is not in the public report. The command downloads an archive into the user’s profile, unzips it, and launches the Python runtime and the compiled loader bootstrap-fat.pyc.

Execution is the Python 3.12.9 runtime plus the 39 MB compiled loader. The loader is a PyInstaller-style bundle that unpacks roughly 120 encrypted Python modules into a temporary directory. The modules are PyArmor 9.2.5 protected. The loader runs them in memory.

Persistence is established within seconds of the loader starting. The four mechanisms, scheduled task, TypeLib COM scriplet hijack, TaskCache manipulation, and the NTUSER.MAN mandatory profile forge, are all run in parallel. The Hive Mind persistence, because it requires no privilege and produces no events, is the load-bearing mechanism. The others are belt and braces.

Defense evasion is the architecture itself. There is no separate defense evasion step, because every step of the framework is designed to look like normal Microsoft 365 use. The headless Edge instance is launched with flags that look like developer debugging, which is plausible enough on a developer machine but is anomalous on a finance or HR workstation.

Credential access is the most operationally dangerous capability. On receipt of a credz_waiting command from the SharePoint dead drop, the implant renders a Tkinter-built fake Windows lock screen populated with their actual display name, account image, and lock screen wallpaper. The lock screen collects the password twice. It does not validate either entry. Both entries are exfiltrated to the SharePoint dead drop and forwarded to the operator.

Discovery is implicit. The implant can take screenshots, list running processes, and enumerate the local network. Ontinue did not detail the discovery modules in the public report, which is the standard trade-off between defensive guidance and operational security for the operator.

Lateral movement is via the reverse SOCKS5 tunnel that the implant opens. The tunnel is wrapped in WebRTC DataChannel traffic relayed by Microsoft Teams TURN servers. The operator uses the tunnel to reach ports 445, 3389, 5985, and 1433 on internal hosts. From a defender’s perspective, the connections look like the user’s endpoint is making ordinary Microsoft Teams media connections. From the operator’s perspective, the connections look like RDP, SMB, WinRM, and MSSQL.

Command and control runs in two parallel channels. The SharePoint dead drop, polled every fifteen seconds, carries the automated tasking. The Teams TURN relay carries interactive access whenever the operator wants to drive the keyboard. Polling does the workhorse duty. The relay kicks in for the moments when automation is not enough.

Exfiltration uses the same channels. Files staged for exfiltration are uploaded to the operator’s SharePoint drive. Operationally, the operator can pull files through the SOCKS5 tunnel using whatever tool is convenient.

MITRE ATT&CK mapping

The framework maps cleanly to the ATT&CK matrix. The list below is conservative. Where the public report is silent on a specific subtechnique, I have not invented a mapping.

Tactic	Technique	Evidence
Initial Access	T1566 Phishing, T1204 User Execution	Social engineering over Teams to run a PowerShell command
Execution	T1059 Command and Scripting Interpreter, T1059.006 Python	Python 3.12.9 runtime with compiled loader
Persistence	T1547 Boot or Logon Autostart Execution, T1546.009 AppCert DLLs, T1547.001 Registry Run Keys, T1546.015 Event Monitor	Scheduled task, TypeLib COM scriplet hijack, TaskCache manipulation, NTUSER.MAN mandatory profile forge
Defense Evasion	T1036 Masquerading, T1553 Subvert Trust Controls	Headless Edge instance runs from a trusted path; PyArmor encryption on modules
Credential Access	T1056 Input Capture, T1110 Brute Force (where credz_waiting is used)	Fake Windows lock screen, password collection
Discovery	T1082 System Information Discovery, T1018 Remote System Discovery	Screenshots, process list, network enumeration
Lateral Movement	T1021 Remote Services, T1090 Proxy	Reverse SOCKS5 tunnel over Teams TURN relay; SMB, RDP, WinRM, MSSQL
Collection	T1005 Data from Local System, T1113 Screen Capture	Screenshot module, file staging
Command and Control	T1071 Application Layer Protocol, T1102 Web Service, T1090 Proxy	SharePoint dead drop over Graph API; Teams TURN relay; headless Edge
Exfiltration	T1041 Exfiltration Over C2 Channel	Upload to operator’s SharePoint drive

What makes the technique unusually clever, dangerous, or historically important

Three things.

The headless Edge instance captures the architectural insight. Anyone who has spent time in offensive tooling knows that the loudest signal in any intrusion shows up as command and control network traffic. Domain reputation catches most of it. IP reputation catches most of the rest. Process name and parent process heuristics catch what the network sensors miss. TWINLOOT sidesteps all three by using their own signed browser process to make API calls against Microsoft’s own infrastructure, so the network connection looks like ordinary Microsoft 365 sync, the process looks like the user’s own Edge session, and the destination sits inside a Microsoft domain. The framework’s only operational security concern, in the end, becomes its own SharePoint dead drop. The architecture is, in the offensive tradecraft sense, beautiful.

The Corrupting the Hive Mind persistence is the operational insight. The technique, published by Praetorian in January 2026 as a research artifact, had not been observed in the wild before TWINLOOT. It uses the Windows API to forge a mandatory user profile hive offline. The forged hive contains the implant’s persistence. When the user logs in, Windows applies the mandatory profile, which loads the implant. Password resets do not reach it. Registry wipes do not reach it. A full operating system reinstall only reaches it if the implant has not already placed a backup of the hive somewhere off the system image, and the implant can do that. The technique is rare because it is hard to implement. Ontinue recovered and reverse engineered it. That is the defensive value of this disclosure.

The seven week infrastructure staging is the tradecraft insight. The operator registered two recently expired domains to inherit their reputation, then aged them quietly for weeks before using them. The SharePoint dead drop is in an Azure tenant the operator controls. The Teams TURN relay abuse depends on the Microsoft TURN infrastructure the operator pays nothing for. The architecture has no dedicated server, no dedicated IP address, and no dedicated domain. There is nothing for a defender to take down. Even if the operator’s SharePoint tenant is removed, the operator registers a new Azure tenant, restores the dead drop, and continues.

The attacker’s operational discipline and mistakes

The tradecraft is high. The operator ran a four day campaign, then stopped, then waited, then continued on the same endpoints for another two days, in a manner consistent with operator handovers and shift work rather than a fully automated run. The operator aged infrastructure before use. The operator used PyArmor 9.2.5 Pro to protect the modules, and used a custom Python port of the Praetorian TURNt tool, rather than a stock open source variant, to make signature detection harder. The operator registered domains in advance, paid for the Azure tenant, and used Microsoft’s own TURN servers rather than renting dedicated relay infrastructure. That is mature tradecraft.

The mistakes are smaller. The PyArmor protection was sufficient against standard dynamic analysis but not against static unpacking with Pyarmor-Static-Unpack-1shot, which is how Ontinue recovered 115 of the 120 modules. The 160 MB operational archive that Dream recovered from a separate Taiwan investigation was, per Ontinue’s account of TWINLOOT, exposed in a similar manner, though Ontinue did not specify where they recovered the artifacts. The operator’s choice to make the credential harvester render a Tkinter fake lock screen is operationally questionable, because legitimate Windows lock screens are not Python processes and the appearance of one on a Windows desktop is a strong, visible anomaly. Most experienced operators have moved to in-process credential capture rather than full UI replication.

Known exploitation in the wild and realistic scope of exposure

Ontinue discovered TWINLOOT during the investigation of an active campaign in July 2026. The firm did not publish the number of victims, the names of the victims, the sectors involved, or the geographic distribution. The report does not include a hash list, a domain list, or a YARA rule. Defenders can read the technical analysis, but cannot download a packaged indicator set.

The realistic scope of exposure is the entire Microsoft 365 enterprise install base. Any enterprise that uses SharePoint, Teams, and Edge is in the threat model. The defensive controls that the framework defeats, domain reputation, IP blocking, and process name heuristics, are the controls the average enterprise relies on most. The framework is not, at this point, in widespread distribution, but the disclosure of its architecture means that copycats are now feasible. The technical bar to building a less capable variant is low. The technical bar to building a fully capable variant is moderate, and falling.

Attribution claims, confidence levels, and competing explanations

Ontinue did not attribute TWINLOOT to a named threat actor. The firm described the operator as having a high level of offensive tradecraft and a deep familiarity with Microsoft cloud architecture, but did not name an actor, a country, or a campaign. The report did not link TWINLOOT to any other known operation, and Ontinue did not comment on whether the campaign is connected to the separate autonomous AI agent breach disclosed this week.

Confidence levels: high on the framework’s technical capabilities, because Ontinue recovered 115 of 120 modules and the static analysis is verifiable. Moderate on the operator’s tradecraft, because the public report does not include full command logs and the seven week staging timeline is a single source claim. Low on attribution, because no source has named an actor.

Competing explanations: it is possible that TWINLOOT is a research artifact, developed by a defensive firm to test its own detection stack. The architecture is plausible enough that this is a non-trivial possibility. The assessment Ontinue’s report invites is that the malware is real, but the report does not produce evidence that excludes the alternative. Defenders should treat the framework as real, plan for it, and not assume attribution has been established.

Comparison with earlier attacks and related families

The closest comparable is the DragonForce ransomware variant Backdoor.Turn, which was observed in early 2026 using Teams TURN relay abuse. Backdoor.Turn used TURN routing only, not the full WebRTC DataChannel layer that TWINLOOT uses, and did not combine that abuse with SharePoint dead drop tasking. The Praetorian TURNt research, disclosed in 2025, established the technical foundation for both. Ontinue’s report describes TWINLOOT as the second observed case of Teams TURN abuse in the wild, and the first to use DataChannels.

The other comparable is STAC4749, a separate campaign that Ontinue’s report compares TWINLOOT against. STAC4749 used some of the same tradecraft but did not combine all three primitives. The table in the report, which I have not reproduced here because it is dense and depends on specific sample data, makes clear that TWINLOOT is materially more capable than STAC4749 in every relevant dimension.

The most important historical parallel is the LAPSUS$ group’s 2022 social engineering playbook, which used phone calls and Teams messages to obtain initial access and then lived off the cloud. TWINLOOT is the technical realization of the LAPSUS$ idea. Where LAPSUS$ relied on the human operator’s tradecraft to keep C2 quiet, TWINLOOT removes the human from the loop on the network traffic side, by putting C2 inside the cloud services the organisation already trusts.

Detection opportunities, log sources, and behavioral warning signs

The framework is hard to detect, but not undetectable. The detection opportunity is in the behaviour, not the artefacts. The artefacts are clean Microsoft artefacts. The behaviour is unusual Microsoft behaviour.

Graph API traffic from headless Edge processes. Edge instances launched with the headless flag, the remote-debugging-port flag, or other DevTools Protocol flags, when their parent process is pythonw.exe or another non-browser process, is a strong indicator. Sysmon Event ID 1, process creation, captures the command line. Microsoft Defender for Endpoint, SentinelOne, and CrowdStrike can correlate process creation with subsequent network connections.

Teams TURN relay abuse. Teams TURN traffic is normally bidirectional media between two endpoints. A single endpoint that maintains a long lived encrypted tunnel to the TURN infrastructure, particularly outside of an active call, is anomalous. Network sensors that can see Teams traffic (Zscaler, Netskope, Microsoft Defender for Cloud Apps) can detect this. Most enterprises cannot.

NTUSER.MAN hive creation. The forged mandatory profile hive is written to the user’s profile directory. The file NTUSER.MAN should not normally exist in a user’s profile. File creation monitoring on the user’s profile directory can catch this. Most endpoint agents do not file watch by default on the user profile.

PowerShell downloading and executing Python. The initial access sequence, PowerShell downloading an archive, PowerShell invoking Python, Python launching a headless Edge, is a strong multi-stage behavioural indicator. Microsoft Defender for Endpoint has a built-in detection for this sequence. SentinelOne and CrowdStrike can write custom detections for it.

Fake Windows lock screens. The Tkinter lock screen is a Python GUI process rendering a full screen window. A Python process with a visible top level window, owned by a user, on a Windows desktop, is unusual. User reports of lock screen anomalies are a detection signal that the technical controls do not have.

Entra ID audit events. The SharePoint dead drop is in an attacker controlled Azure tenant, not the affected organisation\u2019s, so no Entra ID audit event fires in the affected user\u2019s tenant. The access token used by the headless Edge instance to authenticate to the operator’s SharePoint tenant is, however, issued by Entra ID, and a token issued to a service principal that is unfamiliar, or to a token that is replayed from the user’s session, can be detected. Microsoft Entra ID risk signals and continuous access evaluation can flag this.

Outbound connections to unfamiliar Azure tenants. The dead drop is in an attacker controlled Azure tenant. The tenant ID is in the token. A defender that has an inventory of Azure tenants the organisation has a business relationship with can flag connections to unfamiliar tenants. Few enterprises maintain this inventory.

Patches, mitigations, containment, recovery, and verification

There is no patch. The framework is not a vulnerability in any specific Microsoft product. The mitigations are detection and control changes.

Detection first. Audit every endpoint for the indicators above. The strongest indicator is the headless Edge launch with non browser parent. Hunt for it.

Contain the trust path. Disable or restrict Microsoft Teams external access. If the organisation allows external Teams messages, that channel is the operator’s social engineering vector. If the organisation has not rolled out external Teams access controls, this is the time.

Reset credentials. Reset all credentials the operator could have captured, including the credentials of every user who received an unsolicited Teams message from an internal IT persona in the last ninety days. Rotate all application secrets, all service principal secrets, and all OAuth refresh tokens.

Force re authentication. Invalidate all active sessions in Entra ID. Force every user to re authenticate with phishing resistant authentication (FIDO2, Windows Hello, certificate based). Disable any fallback to weaker authentication methods that the framework may have used.

Audit SharePoint dead drop access. Audit every access to SharePoint from the corporate tenant for the last ninety days. The dead drop is in an attacker controlled tenant, so the access will be from a user agent that is not the user’s normal user agent, and the access pattern will be at a fifteen second cadence, which is not a normal SharePoint sync cadence.

Contain the SOCKS5 tunnel. The reverse SOCKS5 tunnel is a long lived encrypted connection. Network sensors that can see inside Teams TURN traffic can detect it. Disable Teams external media access. Disable Teams TURN for tenant to tenant calls. The trade off is degraded cross tenant Teams call quality.

Hunt for the Hive Mind persistence. Search every endpoint in the organisation for a file named NTUSER.MAN in any user profile. The file should not exist on a normal Windows install. If it exists, the endpoint is compromised.

Verify recovery. After containment, run a thirty day hunt for the indicators. The operator will, if the framework is mature, attempt re entry. The re entry vector will be the same. The detection will be the same.

Practical recommendations

For individuals. Treat any unsolicited Microsoft Teams message from an internal IT persona as suspicious. Verify by voice or by a separate Teams message to a known good address. Do not run PowerShell commands sent in a chat. If a lock screen looks wrong, check that the screen saver is the Windows default, that the time is correct, and that the wall paper matches what you set. If any of those are off, do not enter your password. Report the incident to IT through a channel you trust.

For administrators. Disable external Teams access unless the business requires it. Implement Conditional Access policies that require phishing resistant authentication for all Microsoft 365 access. Implement Continuous Access Evaluation. Maintain an inventory of Azure tenants the organisation has a business relationship with. Audit every access to an unfamiliar Azure tenant.

For developers. If your endpoint is a development workstation, the indicators above will have higher false positive rates. The DevTools Protocol is a legitimate developer tool. The compensating control is to log every headless Edge launch with its command line and parent process, and to alert on the parent being a non browser process. Tune the alerts. Do not silence them.

For security teams. The framework is a forcing function. The detection gap is in the behaviour of trusted software on trusted infrastructure. The defensive industry has spent fifteen years building controls for known bads. The next ten years will be spent building controls for permitted behaviours. Start now. The detection opportunities above are the easy ones. The hard ones are the long term behavioural baselines that will catch the next variant of this framework.

Remaining unanswered questions

Who is the operator. The report does not name the actor, the sector, or the geography. This is a question Ontinue may answer in a follow-up, or may not.

How many victims. The report does not give a victim count. The single campaign in July is described as ongoing when the framework was discovered. The total number of infected endpoints across the campaign’s lifetime is unknown.

Is the framework shared. The operator could be a single actor, a small group, or a shared toolkit. The seven week infrastructure staging is consistent with a single actor, but is not evidence of exclusivity.

What is the operator’s exfiltration target. The credential harvester and the SOCKS5 tunnel are general purpose. The actual target, intellectual property, financial data, personal data, or operational technology, is not described in the report.

How does the operator’s kill switch work. The dead drop is a SharePoint drive. The operator can delete files from the drive to stop issuing commands. The framework has no documented dead drop health check. If the operator loses the tenant, the implant may sit inert indefinitely.

What is the next variant. The architecture is now in the public record. The defensive industry should expect, within ninety days, a copycat framework that does most of what TWINLOOT does and that uses a different share of the Microsoft 365 stack, perhaps OneDrive, perhaps Exchange Web Services, perhaps Outlook.com. The structural problem is the absence of behavioural detection on trusted cloud traffic. The variants will keep coming until that problem is addressed.

Defensive checklist

• Audit endpoints for headless Edge instances with non browser parent processes
• Audit endpoints for NTUSER.MAN files in user profile directories
• Audit endpoints for PowerShell downloads of Python archives followed by Python execution
• Audit Entra ID for unfamiliar Azure tenant accesses
• Audit Teams for unsolicited internal IT messages, particularly those requesting PowerShell execution
• Disable external Teams access where business allows
• Enforce phishing resistant authentication for all Microsoft 365 access
• Implement Continuous Access Evaluation in Entra ID
• Maintain an inventory of Azure tenants the organisation has a business relationship with
• Reset all credentials, application secrets, and OAuth refresh tokens for affected users
• Validate lock screen behaviour and report anomalies to IT
• Plan for the next variant, and the next, and the next

The bottom line

Geist Verdict

Sophistication: High. The disclosed tradecraft combines primitives the industry has been treating as separate problems and uses them as a single channel. The Hive Mind angle shows Windows internals depth that is rare outside offensive research shops. The patience of the staging timeline reads as professional rather than hurried.

Originality: High. Each piece has surfaced before. The way the pieces snap together has not. The DataChannel layer on the relay abuse has not been public. The combination of headless transport plus mandatory profile persistence has not been written about until now.

Impact: Moderate. The active run was contained before the disclosure went out. The reported damage was significant for one organisation. The wider question is the question the next ninety days will answer, and the answer will almost certainly be a copycat that picks a different slice of the same surface.

Stealth: Very high. The whole point of the architecture is to be invisible to the controls most enterprises actually run. The detection opportunities exist but they ask for behavioural baselining and cloud traffic inspection that most shops have not yet stood up at the endpoint.

What to do this week: Hunt for headless browser launches owned by a non browser parent. Sweep every profile directory for a file named NTUSER.MAN. Pull the last ninety days of access to unfamiliar tenants from the identity logs. None of this is glamorous and all of it is the work the next quarter demands.

One phrase from the disclosure is worth borrowing for the era it kicks off. Living off the land meant attackers using the operating system’s own tools. The implant published this week is the move up the stack. The next decade of defensive work is the work of learning to detect, on the cloud, what we spent fifteen years learning to detect on the host. The clock started this week.

---

Sources & Further Reading

• Ontinue, Living Off the Cloud: A Python Implant Hiding Its Entire C2 Inside Microsoft 365 and Azure, published August 18, 2026. https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/
• The Hacker News, TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks, published August 18, 2026. https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html
• SC Media, ‘TWINLOOT’ Python implant abuses Microsoft services for stealthy C2, published August 19, 2026. https://www.scworld.com/news/twinloot-python-implant-abuses-microsoft-services-for-stealthy-c2
• CSO Online, New malware turns Microsoft cloud into its control center, published August 19, 2026. https://www.csoonline.com/article/4210973/new-malware-turns-microsoft-cloud-into-its-control-center.html
• Praetorian, TURNt: Abusing Microsoft Teams TURN Server for C2, original research disclosure, 2025 (referenced by Ontinue as the source of the TURNt toolkit that TWINLOOT ports to Python).
• Praetorian, Corrupting the Hive Mind: Abusing Mandatory Windows User Profiles for Persistence, original research disclosure, January 2026 (referenced by Ontinue as the first in-the-wild adaptation of this persistence technique).

Spotted an error? Email the editor. Corrections are issued with a visible correction note.

Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.