---
title: "Discussion on \"TWINLOOT: When Microsoft Cloud Becomes a Hacker's \"Control Center\"\" | Hashnode"
description: "Discussion on \"TWINLOOT: When Microsoft Cloud Becomes a Hacker's \"Control Center\"\". Imagine a nightmare scenario for every SOC team: An attacker lies deep inside the internal network for weeks, silently opening up to 128 administrative connection streams (SMB, RDP, WinRM) to move lat"
url: "https://hashnode.com/posts/twinloot-when-microsoft-cloud-becomes-a-hacker-s-control-center/6a94e46c76cf213b3ee03fe2"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [TWINLOOT: When Microsoft Cloud Becomes a Hacker's "Control Center"](https://blog.fiscybersec.com/twinloot-when-microsoft-cloud-becomes-a-hacker-s-control-center?utm_source=hashnode&utm_medium=feed)

Imagine a nightmare scenario for every SOC team: An attacker lies deep inside the internal network for weeks, silently opening up to 128 administrative connection streams (SMB, RDP, WinRM) to move lat

Aug 31 · 11 min read · blog.fiscybersec.com  
Read the article

-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)
-   [#twinloot](https://hashnode.com/tag/twinloot)
-   [#microsoft-cloud](https://hashnode.com/tag/microsoft-cloud)
-   [#c2](https://hashnode.com/tag/c2)
-   [#microsoft-365](https://hashnode.com/tag/microsoft-365)

## Written by

[Lưu Tuấn Anh](https://hashnode.com/@anhlt120)

@anhlt120

  
[View profile](https://hashnode.com/@anhlt120)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.