06/18/2026
Threat Alert: DragonForce Abuses Microsoft Teams Relay Infrastructure
Threat actors linked to DragonForce ransomware have been observed using a custom Go-based RAT known as Backdoor.Turn to hide command-and-control traffic through Microsoft Teams relay infrastructure.
According to Symantec and Carbon Black, the malware used legitimate Microsoft TURN relay services so defenders would only see outbound traffic to Microsoft Teams servers.
Key details:
• Custom RAT: Backdoor.Turn
• Linked to DragonForce ransomware activity
• C2 traffic hidden through Microsoft Teams relay infrastructure
• Attackers reportedly remained in the environment for 1–2 months
• Capabilities include command ex*****on, network scanning, AD/LDAP search, lateral movement, and credential theft
• Activity also involved DLL side-loading and BYOVD techniques to evade security tools
This highlights a growing challenge for defenders: attackers are increasingly abusing trusted services to blend malicious traffic into normal business activity.
Organizations should review outbound traffic patterns, monitor for unusual Teams-related connections, investigate suspicious PowerShell activity, and validate endpoint controls against DLL side-loading and vulnerable driver abuse.
Trusted infrastructure does not always mean trusted activity.
