# DragonForce hides C2 in Teams relay

Published: 2026-06-18 · Severity: high
Canonical: https://vorant.io/reports/da5bf98e-1a30-5f46-89ca-bfd4100540cc/dragonforce-hides-c2-in-teams-relay

> DragonForce ransomware operators deployed a custom Go backdoor that tunnels C2 traffic through Microsoft Teams infrastructure, remaining undetected for 1-2 months in a U.S. firm.

Threat actors behind the DragonForce ransomware operation have deployed a sophisticated custom backdoor called Backdoor.Turn that conceals command-and-control communications within Microsoft Teams relay infrastructure. The attack, documented by Symantec and Carbon Black, targeted a major U.S. services company and represents the first publicly known abuse of Microsoft's TURN relay system for malicious purposes. The attackers maintained persistence for one to two months while their traffic appeared as legitimate connections to Microsoft Teams servers.

The intrusion chain began in December 2025, likely through exploitation of an SQL server vulnerability or via an initial access broker. Attackers deployed malware disguised as a tech support hotfix, leveraging DLL side-loading and bring-your-own-vulnerable-driver (BYOVD) techniques using multiple signed but vulnerable drivers including a Huawei audio driver. After deploying the DragonForce ransomware payload, the attackers injected Backdoor.Turn into a legitimate Sysinternals process to maintain continued access.

Backdoor.Turn employs a novel evasion technique first documented as "Ghost Calls" by Praetorian in 2024. The backdoor obtains anonymous visitor tokens from Microsoft's Skype-backed identity services, uses legitimate Microsoft TURN relay servers during connection setup, then establishes a QUIC session to the attacker's actual C2 infrastructure. The backdoor supports extensive post-exploitation capabilities including credential theft, Active Directory enumeration, lateral movement, and network scanning. The operation demonstrates DragonForce's evolution from a conventional ransomware-as-a-service model to what researchers describe as a highly organized cartel structure with advanced persistent capabilities.

## Mentioned in this report

- Vulnerabilities: CVE-2023-52271, CVE-2025-1055, CVE-2025-61155
- Threat actors: DragonForce
- Malware: ABYSSWORKER, Backdoor.Turn, DragonForce

## Detection guidance (public sample)

### Suspicious Kernel Driver Service Creation (Potential BYOVD)

ATT&CK: T1068

Detects sc.exe or registry-based creation of a kernel-mode driver service, consistent with BYOVD abuse of signed-but-vulnerable drivers (e.g. Huawei audio driver) to gain elevated privileges before deploying ransomware payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Kernel Driver Service Creation via sc.exe
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \\sc.exe
    CommandLine|contains: kernel
  filter_common:
    CommandLine|contains:
    - \\Windows\\System32\\drivers\\
    - WdFilter
    - wof.sys
  condition: selection and not filter_common
falsepositives:
- Legitimate driver installation by IT/OEM software (e.g. printer or audio driver
  updates) from standard system driver paths
- EDR/AV agent driver installation during deployment or upgrade
level: high
tags:
- attack.t1068
- attack.defense-evasion
- attack.privilege-escalation
id: 1f02fc9e-da94-5881-896e-d2a56173af43
status: experimental
author: Vorant
```

### Process Injection Targeting Sysinternals Utility

ATT&CK: T1055

Detects CreateRemoteThread/QueueUserAPC injection where the target process is a legitimate Sysinternals utility, matching Backdoor.Turn's technique of injecting into a signed Sysinternals binary to maintain covert access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Remote Thread Creation Targeting Sysinternals Binary
logsource:
  category: create_remote_thread
  product: windows
detection:
  selection:
    TargetImage|endswith:
    - \\procexp.exe
    - \\procexp64.exe
    - \\procdump.exe
    - \\procdump64.exe
    - \\psexec.exe
    - \\psexec64.exe
    - \\tcpview.exe
    - \\autoruns.exe
    - \\autorunsc.exe
    - \\pslist.exe
    - \\pssuspend.exe
  filter_selfstart:
    SourceImage: TargetImage
  condition: selection and not filter_selfstart
falsepositives:
- Administrators launching Sysinternals tools that legitimately spawn helper threads
  in themselves
- Security tooling that instruments Sysinternals binaries for monitoring
level: high
tags:
- attack.t1055
- attack.defense-evasion
id: 12685a35-4e7d-558f-9277-039c034b9405
status: experimental
author: Vorant
```

### Anomalous QUIC/UDP 443 Session from Non-Browser Non-Teams Process

ATT&CK: T1090.001

Detects a process other than known browsers or Microsoft Teams establishing outbound QUIC-style UDP/443 connections, consistent with Backdoor.Turn abusing Microsoft TURN relay infrastructure and QUIC to reach attacker C2 while blending with legitimate Teams traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unusual Process Generating Outbound UDP 443 QUIC Traffic
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Protocol: udp
  filter_known:
    Image|endswith:
    - \\msteams.exe
    - \\teams.exe
    - \\chrome.exe
    - \\msedge.exe
    - \\firefox.exe
    - \\ms-teams.exe
  condition: selection and not filter_known
falsepositives:
- Other legitimate applications that use QUIC/HTTP3 (e.g. some CDN-backed enterprise
  apps)
- Custom browsers or Electron-based collaboration tools not included in the allowlist
level: medium
tags:
- attack.t1090.001
- attack.t1071.001
- attack.command-and-control
id: c6849fa9-a349-542b-8cbd-93d2f9d02b05
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thehackernews.com/2026/06/dragonforce-hackers-abuse-microsoft.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/da5bf98e-1a30-5f46-89ca-bfd4100540cc/dragonforce-hides-c2-in-teams-relay.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup