[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPbG3miGj-JUQlJ59Ni5Q0I7z0PWLkkvJDm5lFA-WIXU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"4c76a096-8667-4f7e-9727-a2eeec3199b0","dragonforce-abuses-microsoft-teams-relay-servers-to-hide-ransomware-c2-traffic","95f178ee-4be7-4a54-a8d6-3e428e672fa8","DragonForce Abuses Microsoft Teams Relay Servers to Hide Ransomware C2 Traffic","The DragonForce ransomware group exploited Microsoft Teams TURN relay servers to disguise malicious command-and-control traffic as legitimate corporate communications, making detection extremely difficult. Attackers gained initial access using stolen credentials and leveraged DLL sideloading and Bring Your Own Vulnerable Driver (BYOVD) techniques to achieve deep system persistence before deploying ransomware. This attack highlights the danger of blindly trusting traffic from well-known SaaS platforms without inspecting it for anomalies. Organizations that fail to scrutinize outbound traffic to trusted services create a hidden channel that attackers can exploit with impunity. The incident underscores that perimeter-based trust of legitimate application traffic is no longer sufficient in a modern threat landscape.","**Immediate actions:**\n- Audit and restrict outbound connections to Microsoft Teams relay servers by enforcing allowlists limited to known corporate endpoints.\n- Rotate all privileged credentials immediately and enforce phishing-resistant MFA across all accounts to eliminate stolen credential reuse.\n- Deploy EDR solutions capable of detecting DLL sideloading and BYOVD driver abuse patterns on all endpoints.\n\n**Long-term improvements:**\n- Implement zero-trust network architecture so that even traffic to trusted SaaS platforms is inspected and contextualized before being allowed.\n- Enforce strict driver signing policies and use Windows Defender Credential Guard and HVCI to prevent BYOVD techniques.\n- Segment internal networks so that a compromised endpoint cannot freely communicate outbound through collaboration platforms without explicit policy approval.\n\n**Detection measures:**\n- Enable deep packet inspection and behavioral analytics to flag unusual volumes or patterns of traffic routed through Microsoft Teams TURN\u002FSTUN relay infrastructure.\n- Monitor for anomalous process behavior such as unexpected parent-child process relationships and unsigned DLL loads indicative of sideloading.\n- Establish a baseline of normal Teams traffic per user and alert on deviations that may indicate covert C2 channel usage.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 9 – Limitation and Control of Network Ports, Protocols, and Services","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 CM-7 – Least Functionality","NIST CSF DE.AE-3 – Event Data Aggregated and Correlated","MITRE ATT&CK T1218 – System Binary Proxy Execution (DLL Sideloading)","MITRE ATT&CK T1543 – Create or Modify System Process (BYOVD)","MITRE ATT&CK T1071 – Application Layer Protocol (C2 over trusted services)","ITIL Service Configuration Management – Baseline and monitor trusted application behavior",{},"published","2026-06-17T12:20:58.900087+00:00","2026-06-17T12:20:58.586+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002Fmicrosoft-teams-relay-servers-abused-in-dragonforce-ransomware-attack\u002F","microsoft-teams-relay-servers-abused-in-dragonforce-ransomware-attack-a3de47","Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"45e2c08a-940b-4448-aad5-5ebffaca96b2","2026-06-17","afternoon","ThreatNoir Afternoon Brief — June 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-17\u002Fthreatnoir-afternoon-brief-2026-06-17.mp3",[59,63,67],{"slug":60,"name":61,"problem":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":64,"name":65,"problem":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":68,"name":69,"problem":70},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]