Topic

TURN relay abuse

Misuse of TURN (Traversal Using Relays around NAT) servers, which relay real-time traffic for calling and meeting services, to tunnel attacker traffic through trusted infrastructure.

Current clusters

security2 publishers

TWINLOOT runs its entire C2 inside Microsoft 365, and your egress filter will not see it

Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.

Publishers:scworld.comthehackernews.com

Reality

Evidence62
Adoption: Insufficient
Hype gap+20
Incentives40
Confidence60