New malware turns Microsoft 365 and Azure into its control center

Security researchers are warning of a newly uncovered Python malware framework that routes much of its command-and-control (C2) activity through Microsoft services that defenders already expect to see. The Ontinue Cyber Defense Center discovered the implant while investigating an active campaign in July and has since tracked it as TWINLOOT. It was seen using SharePoint Online as a file-based dead drop, Microsoft Teams’ TURN infrastructure for interactive communications, and a headless instance of the victim’s own Edge browser to send Microsoft Graph API requests. Its primary C2 traffic can terminate in Microsoft IP space rather than an attacker-controlled domain, Ontinue researchers said in a report shared with CSO ahead of its publication Tuesday. “TWINLOOT works because defenders have been trained to treat Microsoft traffic as safe by default, and this malware was built to take full advantage of that,” said Shane Barney, chief information security officer at Keeper Security. “There is no attacker-owned domain in the chain, which means the traffic looks exactly like what it is supposed to look like, and most detection tools will leave it alone.” Microsoft did not immediately resp…