DragonForce hides C2 in Teams relay
DragonForce ransomware operators deployed a custom Go backdoor that tunnels C2 traffic through Microsoft Teams infrastructure, remaining undetected for 1-2 months in a U.S. firm.
Sourcethehackernews.com — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Threat actors behind the DragonForce ransomware operation have deployed a sophisticated custom backdoor called Backdoor.Turn that conceals command-and-control communications within Microsoft Teams relay infrastructure. The attack, documented by Symantec and Carbon Black, targeted a major U.S. services company and represents the first publicly known abuse of Microsoft's TURN relay system for malicious purposes. The attackers maintained persistence for one to two months while their traffic appeared as legitimate connections to Microsoft Teams servers.
The intrusion chain began in December 2025, likely through exploitation of an SQL server vulnerability or via an initial access broker. Attackers deployed malware disguised as a tech support hotfix, leveraging DLL side-loading and bring-your-own-vulnerable-driver (BYOVD) techniques using multiple signed but vulnerable drivers including a Huawei audio driver. After deploying the DragonForce ransomware payload, the attackers injected Backdoor.Turn into a legitimate Sysinternals process to maintain continued access.
Backdoor.Turn employs a novel evasion technique first documented as "Ghost Calls" by Praetorian in 2024. The backdoor obtains anonymous visitor tokens from Microsoft's Skype-backed identity services, uses legitimate Microsoft TURN relay servers during connection setup, then establishes a QUIC session to the attacker's actual C2 infrastructure. The backdoor supports extensive post-exploitation capabilities including credential theft, Active Directory enumeration, lateral movement, and network scanning. The operation demonstrates DragonForce's evolution from a conventional ransomware-as-a-service model to what researchers describe as a highly organized cartel structure with advanced persistent capabilities.
Mentioned in this report
Detection guidance
Suspicious Kernel Driver Service Creation (Potential BYOVD)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects sc.exe or registry-based creation of a kernel-mode driver service, consistent with BYOVD abuse of signed-but-vulnerable drivers (e.g. Huawei audio driver) to gain elevated privileges before deploying ransomware payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kernel Driver Service Creation via sc.exe
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \\sc.exe
CommandLine|contains: kernel
filter_common:
CommandLine|contains:
- \\Windows\\System32\\drivers\\
- WdFilter
- wof.sys
condition: selection and not filter_common
falsepositives:
- Legitimate driver installation by IT/OEM software (e.g. printer or audio driver
updates) from standard system driver paths
- EDR/AV agent driver installation during deployment or upgrade
level: high
tags:
- attack.t1068
- attack.privilege-escalation
id: 1f02fc9e-da94-5881-896e-d2a56173af43
status: experimental
author: Vorant
Process Injection Targeting Sysinternals Utility
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects CreateRemoteThread/QueueUserAPC injection where the target process is a legitimate Sysinternals utility, matching Backdoor.Turn's technique of injecting into a signed Sysinternals binary to maintain covert access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Remote Thread Creation Targeting Sysinternals Binary
logsource:
category: create_remote_thread
product: windows
detection:
selection:
TargetImage|endswith:
- \\procexp.exe
- \\procexp64.exe
- \\procdump.exe
- \\procdump64.exe
- \\psexec.exe
- \\psexec64.exe
- \\tcpview.exe
- \\autoruns.exe
- \\autorunsc.exe
- \\pslist.exe
- \\pssuspend.exe
filter_selfstart:
SourceImage: TargetImage
condition: selection and not filter_selfstart
falsepositives:
- Administrators launching Sysinternals tools that legitimately spawn helper threads
in themselves
- Security tooling that instruments Sysinternals binaries for monitoring
level: high
tags:
- attack.t1055
- attack.stealth
id: 12685a35-4e7d-558f-9277-039c034b9405
status: experimental
author: Vorant
Anomalous QUIC/UDP 443 Session from Non-Browser Non-Teams Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a process other than known browsers or Microsoft Teams establishing outbound QUIC-style UDP/443 connections, consistent with Backdoor.Turn abusing Microsoft TURN relay infrastructure and QUIC to reach attacker C2 while blending with legitimate Teams traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unusual Process Generating Outbound UDP 443 QUIC Traffic
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 443
Protocol: udp
filter_known:
Image|endswith:
- \\msteams.exe
- \\teams.exe
- \\chrome.exe
- \\msedge.exe
- \\firefox.exe
- \\ms-teams.exe
condition: selection and not filter_known
falsepositives:
- Other legitimate applications that use QUIC/HTTP3 (e.g. some CDN-backed enterprise
apps)
- Custom browsers or Electron-based collaboration tools not included in the allowlist
level: medium
tags:
- attack.t1090.001
- attack.t1071.001
- attack.command-and-control
id: c6849fa9-a349-542b-8cbd-93d2f9d02b05
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/dragonforce-hackers-abuse-microsoft.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs