[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXdQtioHRX95vEJtv67ueqcGryWPjHXPKM0LfDqzhtR0":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"8ce2267b-0d7c-43bb-ba01-f20e95fb477f","Silent 'TwinLoot' Cyber Threat Operates Entirely From Microsoft's Cloud","silent-twinloot-cyber-threat-operates-entirely-from-microsoft-s-cloud-f626ad","The Python-based malware framework takes living-off-the-land tactics to a new heights of stealth, with a modular implant that steals credentials and achieves persistence.","A new malware framework named 'TwinLoot' has been discovered, leveraging Microsoft's cloud infrastructure to operate with extreme stealth. This Python-based malware employs living-off-the-land tactics, using a modular implant to steal credentials and establish persistence on compromised systems, making it difficult to detect.","New 'TwinLoot' malware uses Microsoft cloud for stealthy credential theft and persistence.","https:\u002F\u002Fwww.darkreading.com\u002Fcloud-security\u002Fsilent-twinloot-threat-operates-microsoft-cloud","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt6eacfb49185ef44e\u002F6a844f6877eb9365311e809b\u002FCloud-Security_Aleksia_Alamy.jpg?width=720&quality=80&disable=upscale","2026-08-18T13:00:00+00:00","2026-08-18T14:00:19.372667+00:00",8,[17,20],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"cloud","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":49,"vendors":133},[50,78,104],{"slug":51,"name":52,"problem":53,"products":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[55,63,70],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":64,"vendor_name":18,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":79,"name":80,"problem":81,"products":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[83,88,96],{"vendor_slug":64,"vendor_name":18,"vendor_logo":65,"product_slug":84,"product_name":85,"url":86,"description":87},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":105,"name":106,"problem":107,"products":108},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":151},"twinloot-malware-abuses-microsoft-cloud-to-evade-detection","TwinLoot Malware Abuses Microsoft Cloud to Evade Detection","The TwinLoot malware framework exploits trusted Microsoft cloud infrastructure to blend malicious activity with legitimate traffic, making traditional signature-based detection largely ineffective. By employing living-off-the-land (LotL) techniques, attackers avoid deploying suspicious binaries, instead weaponizing native tools and trusted cloud services already present in the environment. This modular, Python-based implant can steal credentials and establish persistence while generating minimal noise in security logs. The threat highlights a growing trend of adversaries abusing legitimate cloud platforms to bypass perimeter defenses and erode trust-based detection models. Organizations that rely solely on blacklist-based or perimeter security controls are particularly exposed to this class of attack.",[139,140,141,142,143,144,145,146,147,148,149,150],"CIS Control 3 – Data Protection","CIS Control 8 – Audit Log Management","CIS Control 12 – Network Infrastructure Management","CIS Control 16 – Application Software Security","NIST SP 800-53 AU-2 – Event Logging","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 CA-7 – Continuous Monitoring","MITRE ATT&CK T1059 – Command and Scripting Interpreter","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1567 – Exfiltration Over Web Service","GDPR Article 32 – Security of Processing",{}]