DragonForce hides C2 in Teams relay
DragonForce ransomware operators deployed a custom Go backdoor that tunnels C2 traffic through Microsoft Teams infrastructure, remaining undetected for 1-2 months in a U.S. firm.
Threat actors behind the DragonForce ransomware operation have deployed a sophisticated custom backdoor called Backdoor.Turn that conceals command-and-control communications within Microsoft Teams relay infrastructure. The attack, documented by Symantec and Carbon Black, targeted a major U.S. services company and represents the first publicly known abuse of Microsoft's TURN relay system for malicious purposes. The attackers maintained persistence for one to two months while their traffic appeared as legitimate connections to Microsoft Teams servers.
The intrusion chain began in December 2025, likely through exploitation of an SQL server vulnerability or via an initial access broker. Attackers deployed malware disguised as a tech support hotfix, leveraging DLL side-loading and bring-your-own-vulnerable-driver (BYOVD) techniques using multiple signed but vulnerable drivers including a Huawei audio driver. After deploying the DragonForce ransomware payload, the attackers injected Backdoor.Turn into a legitimate Sysinternals process to maintain continued access.
Backdoor.Turn employs a novel evasion technique first documented as "Ghost Calls" by Praetorian in 2024. The backdoor obtains anonymous visitor tokens from Microsoft's Skype-backed identity services, uses legitimate Microsoft TURN relay servers during connection setup, then establishes a QUIC session to the attacker's actual C2 infrastructure. The backdoor supports extensive post-exploitation capabilities including credential theft, Active Directory enumeration, lateral movement, and network scanning. The operation demonstrates DragonForce's evolution from a conventional ransomware-as-a-service model to what researchers describe as a highly organized cartel structure with advanced persistent capabilities.
Mentioned in this report
Detection guidance
Suspicious Kernel Driver Service Creation (Potential BYOVD)
Detects sc.exe or registry-based creation of a kernel-mode driver service, consistent with BYOVD abuse of signed-but-vulnerable drivers (e.g. Huawei audio driver) to gain elevated privileges before deploying ransomware payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kernel Driver Service Creation via sc.exe
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\sc.exe
CommandLine|contains: kernel
filter_common:
CommandLine|contains:
- \\Windows\\System32\\drivers\\
- WdFilter
- wof.sys
condition: selection and not filter_common
falsepositives:
- Legitimate driver installation by IT/OEM software (e.g. printer or audio driver
updates) from standard system driver paths
- EDR/AV agent driver installation during deployment or upgrade
level: high
tags:
- attack.t1068
- attack.defense-evasion
- attack.privilege-escalation
id: 1f02fc9e-da94-5881-896e-d2a56173af43
status: experimental
author: Vorant
Process Injection Targeting Sysinternals Utility
Detects CreateRemoteThread/QueueUserAPC injection where the target process is a legitimate Sysinternals utility, matching Backdoor.Turn's technique of injecting into a signed Sysinternals binary to maintain covert access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Remote Thread Creation Targeting Sysinternals Binary
logsource:
category: create_remote_thread
product: windows
detection:
selection:
TargetImage|endswith:
- \\procexp.exe
- \\procexp64.exe
- \\procdump.exe
- \\procdump64.exe
- \\psexec.exe
- \\psexec64.exe
- \\tcpview.exe
- \\autoruns.exe
- \\autorunsc.exe
- \\pslist.exe
- \\pssuspend.exe
filter_selfstart:
SourceImage: TargetImage
condition: selection and not filter_selfstart
falsepositives:
- Administrators launching Sysinternals tools that legitimately spawn helper threads
in themselves
- Security tooling that instruments Sysinternals binaries for monitoring
level: high
tags:
- attack.t1055
- attack.defense-evasion
id: 12685a35-4e7d-558f-9277-039c034b9405
status: experimental
author: Vorant
Anomalous QUIC/UDP 443 Session from Non-Browser Non-Teams Process
Detects a process other than known browsers or Microsoft Teams establishing outbound QUIC-style UDP/443 connections, consistent with Backdoor.Turn abusing Microsoft TURN relay infrastructure and QUIC to reach attacker C2 while blending with legitimate Teams traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unusual Process Generating Outbound UDP 443 QUIC Traffic
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 443
Protocol: udp
filter_known:
Image|endswith:
- \\msteams.exe
- \\teams.exe
- \\chrome.exe
- \\msedge.exe
- \\firefox.exe
- \\ms-teams.exe
condition: selection and not filter_known
falsepositives:
- Other legitimate applications that use QUIC/HTTP3 (e.g. some CDN-backed enterprise
apps)
- Custom browsers or Electron-based collaboration tools not included in the allowlist
level: medium
tags:
- attack.t1090.001
- attack.t1071.001
- attack.command-and-control
id: c6849fa9-a349-542b-8cbd-93d2f9d02b05
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/dragonforce-hackers-abuse-microsoft.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free