AI Weekly Malaysia

Ontinue's Cyber Defense Center disclosed TWINLOOT, a PyArmor-hardened Python implant that runs its entire C2 infrastructure inside trusted Microsoft services: SharePoint Online dead drops via Graph API for tasking, Teams TURN servers for interactive WebRTC access, and the victim's own headless Edge browser to ferry traffic so it looks legitimate. Initial access was via a Teams social engineering attack where someone impersonated IT support and convinced a target to run a PowerShell command downloading a 39 MB payload ('bootstrap-fat.pyc').

Why: If your organization uses Microsoft 365 and Teams, this shows a concrete attack chain where those trusted services become the C2 channel itself—SharePoint polling every 15 seconds, Teams TURN relays for reverse shells, and Edge browser traffic that blends into normal usage. The practical takeaway is to tighten Teams external messaging policies and train staff against IT-support impersonation, since that PowerShell one-liner was the entire foothold.

Kaspersky reports new modules in the Cavern C2 framework, used by Iranian-linked group Cavern Manticore against Israeli entities. The toolkit now uses DNS A-record responses to switch between direct HTTPS and a Google Apps Script relay, and a module called HOLLOWGRAPH abuses Microsoft 365 calendar events via the Graph API as a covert two-way C2 channel, dating events to 2050 to avoid detection.

Why: Unless you are building or defending SaaS APIs that could be abused as relay or dead-drop infrastructure (Google Apps Script, Microsoft Graph calendar), this has little direct impact on your work. The concrete takeaway for platform/security builders: legitimate cloud services like Google Apps Script and M365 Graph are increasingly used to hide malicious traffic, so rate-limiting and monitoring of script deployment IDs and calendar event anomalies may be worth reviewing.