A newly discovered Python implant has been observed using a Windows persistence technique that requires no administrative privileges and generates none of the registry events defenders typically monitor, according to managed detection and response firm Ontinue.
The team’s Cyber Defense Center found the framework, which it tracks as TWINLOOT, while investigating an active campaign in July. Of four persistence mechanisms built into it, three are well documented. The fourth forges a mandatory Windows user profile hive offline and places it in the user’s own profile directory.
Windows loads that file in preference to the standard user hive at logon, so anything the attacker built into it runs. Because it is assembled outside the live registry, no registry write occurs at installation, no elevation is required, and most persistence scanning tools do not check for it.
Praetorian published the underlying research in January. Ontinue assessed this is the first time a threat actor has been seen using it against a real target.
The cloud tradecraft is a known pattern, unusually well executed
TWINLOOT’s command and control (C2) runs entirely through Microsoft services. SharePoint carries tasking over the Graph API, Teams relay servers carry interactive operator sessions, and the Graph traffic is issued from a headless instance of the victim’s own Edge browser, so it leaves the endpoint from a signed browser process.
The implant also authenticates to the attacker’s own cloud tenant rather than the victim’s, meaning none of the activity appears in the target’s identity logs.
Each element has precedent, but Ontinue believe this is the first framework to combine all three transports, and the first to route operator sessions through Teams using WebRTC data channels.
“Microsoft IP space, a signed browser process, and valid cloud APIs are evidence of where an action occurred, not whether it was authorized,” Jason Soroko, Senior Fellow at Sectigo told Expert Insights.
“Attackers are no longer hiding traffic inside legitimate services. They are assembling those services into the malware infrastructure itself.”
Initial access came through a Teams call in which an attacker impersonated IT support. The implant also renders a fake Windows lock screen that captures every password typed into it without validating any of them.
What defenders can do now
“The implant builds a mandatory profile hive offline using legitimate Windows APIs, with no registry modification events or elevation required,” Shane Barney, Chief Information Security Officer at Keeper Security told Expert Insights. “Standard detection logic will not surface it.”
Instead, Ontinue recommended flagging endpoints connecting to SharePoint tenants outside your own organisation, restricting Teams external access where not required, and disabling headless mode or remote debugging in Edge, either of which breaks the browser transport.
Python runtimes running from user-writable paths should be treated as suspicious. Any user who may have encountered the fake lock screen should have credentials reset and refresh tokens revoked. Passkeys or FIDO2 keys remove the credential harvest entirely.
The company also noted that the relay technique reached three unrelated actors within a year of the research that described it, and this persistence method within seven months. The gap between conference research and working malware is now measured in weeks.
