GoKawiilA Python-based malware framework is taking the concept of living off the land (LOTL) to a whole new level by operating its entire command-and-control (C2) from inside Microsoft Azure and 365 services, researchers have found. And while it's common for attackers to use cloud infrastructure to hide activity, the framework has some unique qualities that demonstrates new sophistication — and which will require new defensive thinking.
Dubbed "TwinLoot" by the researchers at Ontinue Cyber Defense Center who discovered it, the modular framework uses various Microsoft services, each for a different purpose, thus disguising its activity as legitimate cloud traffic, according to a report published today. Specfically, TwinLoot uses SharePoint Online and the Microsoft Graph API for command-and-control (C2), Microsoft Teams’ TURN relay infrastructure for interactive access, and the victim’s own Microsoft Edge browser to disguise Graph API communications.
Related:Researcher Claims Control of ChatGPT Secure Sandbox
Using this foundation, TwinLoot engages in various malicious activities, including harvesting Windows credentials via pixel-faithful fake lock screens, providing a reverse SOCKS5 pivot into victim networks, executing arbitrary commands, and creating a persistent network presence in various ways, the researchers found.
The last activity is particularly unique, the researchers noted, as it "involved an offline‑forged mandatory profile hive created without administrative privileges," according to the report. They The researchers called the technique "Corrupting the Hive Mind," observing that it's "the first recorded malicious use of this persistence method in the wild."
Cyberattacker-Controlled Cloud Services
The researchers discovered TwinLoot while investigating an ongoing campaign in July, recovering the malware's modules from under PyArmor 9.2.5 protection and decrypting the embedded configuration, according to the report.
While most of TwinLoot's individual LOTL tactics they observed are not new — SharePoint already has been used as a C2 dead-drop, for instance — their combination into a single operational implant is. "TwinLoot is the first we have seen to combine Microsoft 365 dead-drop C2, Teams TURN relay abuse, and headless browser transport within a single framework," according to Ontinue.
"TwinLoot shows how a cloud productivity suite can be turned into an attacker’s control plane," observes Jason Soroko, senior fellow at certificate lifecycle management provider Sectigo. "This weakens controls built around domain reputation, IP blocking, process names, or the assumption that Microsoft 365 traffic represents sanctioned user activity."
Related:Ghost Credentials Expose Cloud Systems to Hidden Identity Risks
... continue reading