Back Ground.News

New malware turns Microsoft cloud into its control center

Ground.News • August 18, 2026

Security researchers are warning of a newly uncovered Python malware framework that routes much of its command-and-control (C2) activity through Microsoft services that defenders already expect to see. The Ontinue Cyber Defense Center discovered the implant while investigating an active campaign in July and has since tracked it as TWINLOOT. It was seen using SharePoint Online as a file-based dead drop, Microsoft Teams’ TURN infrastructure for in…

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TwinLoot Malware Exploits Microsoft Cloud for Command-and-Control Operations A new Python-based malware framework named TwinLoot has been discovered, utilizing Microsoft Azure and 365 services for its command-and-control (C2) operations. Researchers from Ontinue Cyber Defense Center identified the malware while investigating an active campaign in July 2026. TwinLoot employs various Microsoft services, including SharePoint Online for file storage and Microsoft Teams' TURN infrastructure for interactive access, effectively disguising its malicious activities as legitimate cloud traffic. The malware can harvest Windows credentials, execute arbitrary commands, and maintain persistence through innovative techniques, such as creating a forged mandatory profile hive without administrative privileges. This sophisticated approach complicates detection, as the malware's traffic appears to originate from trusted Microsoft services, making it difficult for security tools to flag it as malicious. The threat is particularly concerning due to its potential to bypass traditional security measures that rely on domain reputation and IP blocking. As of now, no specific mitigation strategies have been disclosed. 4 sources 67

Extracted Entities

New malware turns Microsoft cloud into its control center

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)