TwinLoot

highMalware

New TWINLOOT Malware Abuses SharePoint and Teams for Stealthy Command-and-Control

Cybersecurity researchers at Ontinue have disclosed a previously undocumented Python implant framework called TWINLOOT. The malware is hardened with PyArmor and operates its entire command-and-control (C2) infrastructure through SharePoint Online and Microsoft Teams, making detection difficult by blending in with legitimate traffic. The framework is designed for credential theft and lateral movement across networks.

The Hacker Newsabout 1 month ago2 min read

highMalware

Silent TwinLoot Malware Framework Exploits Microsoft Cloud for Stealth Operations

Security researchers have identified a Python-based malware framework operating under the name 'TwinLoot' that leverages Microsoft cloud infrastructure to conduct stealthy operations. The framework employs living-off-the-land tactics to blend with legitimate cloud services, featuring a modular implant capable of credential theft and system persistence.

Dark readingabout 1 month ago1 min read

TwinLoot

Quick answers

Related Articles

New TWINLOOT Malware Abuses SharePoint and Teams for Stealthy Command-and-Control

Silent TwinLoot Malware Framework Exploits Microsoft Cloud for Stealth Operations