DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
DragonForce hackers use Microsoft Teams relays to hide Backdoor.Turn C2 traffic.
Threat actors linked to the DragonForce ransomware have been observed using a custom Go-based RAT, Backdoor.Turn, to conceal command-and-control (C2) traffic within Microsoft Teams relay infrastructure. This sophisticated technique allows attackers to blend malicious communications with legitimate traffic, making detection difficult for network defenders. The attackers gained initial access to a U.S. services firm, likely through an SQL server vulnerability or an initial access broker, and remained undetected for one to two months.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDragonForce ransomware actors exploited a likely unpatched SQL server vulnerability to gain initial access, then deployed a custom Go-based RAT (Backdoor.Turn) that tunneled command-and-control traffic through legitimate Microsoft Teams relay infrastructure. By blending malicious traffic with trusted collaboration platform communications, the attackers evaded detection for one to two months — a dangerously long dwell time. This highlights how attackers increasingly abuse trusted cloud services to bypass traditional perimeter defenses and signature-based detection. The combination of delayed detection and living-off-the-land-style C2 masquerading significantly amplifies the potential for data exfiltration and full ransomware deployment before defenders can respond.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Backdoor.Turn
- malware — DragonForce
- mitre_attack — T1059.001
- mitre_attack — T1574.002
- mitre_attack — T1070.004
- mitre_attack — T1204.002
- mitre_attack — T1055.012
- mitre_attack — T1071.001
- mitre_attack — T1090.003
- mitre_attack — T1555.003
- mitre_attack — T1018
- mitre_attack — T1558.003
- mitre_attack — T1041