threat-intel Silent 'TwinLoot' Cyber Threat Operates Entirely From Microsoft's Cloud TwinLoot, a sophisticated Python-based malware framework, operates entirely from within Microsoft's Azure and 365 cloud services, using various Microsoft services – SharePoint Online, Microsoft Graph API, and Teams TURN relay infrastructure – to conceal its malicious activities. The framework employs advanced living-of… Dark Reading · Aug 18, 2026 High living-off-the-landcloud-basedpersistence
apt Chinese APT deploys new malware to keep access to hacked networks A Chinese Advanced Persistent Threat (APT) group, tracked as UNC5221 (VerdantBamboo), has been conducting a prolonged espionage campaign targeting organizations in the United States, primarily leveraging the Brickstorm b… BleepingComputer · Jun 5, 2026 High CNespionagebackdoorpersistence
