TWINLOOT C2 config fetch via Azure Blob Storage dead-drop (periodic beacon)

Duo Tech@duotech

•updated Aug 20, 2026•0•0•4

Detects periodic beaconing and configuration polling by the TWINLOOT implant using Azure Blob Storage as a dead-drop mechanism. The rules identify specific TLS SNI patterns and HTTP requests for 'cfg.json' files hosted on Azure Blob storage using non-browser user-agents.