Dragon Force Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Summary: Symantec and Carbon Black reported that DragonForce ransomware operators used a custom Go-based RAT called Backdoor.Turn against an undisclosed major U.S. services firm, hiding command-and-control traffic inside Microsoft Teams relay infrastructure by obtaining an anonymous Teams visitor token and using a legitimate Microsoft TURN relay before opening a QUIC session to the attacker's server. Initial activity began in December 2025 with a PowerShell command dropping a ZIP archive posing as a tech support hotfix, followed by DLL side-loading and a BYOVD attack using a Huawei driver (HWAuidoOs2Ec.sys); the attackers remained on the victim network for one to two months.
What you should know: To network defenders, the only visible traffic was outbound connections to legitimate Microsoft Teams servers, and the intruders stayed inside the victim network for one to two months before Backdoor.Turn was injected into the legitimate DbgView64.exe process after ransomware deployment.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026