MalwareUsed by 3 actorsExploits 3 CVEs

Backdoor.Turn

Backdoor.Turn is a custom Go-based remote access trojan associated with DragonForce ransomware intrusions. It is notable for abusing Microsoft Teams TURN relay infrastructure to conceal command-and-control traffic inside trusted enterprise collaboration traffic, causing network monitoring to primarily observe outbound connections to legitimate Microsoft Teams services rather than obviously malicious destinations. The malware obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to establish connectivity, and then runs a QUIC-based session to attacker-controlled infrastructure. This tradecraft has been assessed as the first known in-the-wild malware use of Microsoft Teams TURN relays for covert command and control, reflecting a practical implementation of the Ghost Calls-style tunneling concept.

Backdoor.Turn has been observed in a DragonForce intrusion against a major U.S. services firm, where attackers reportedly maintained access for roughly one to two months before ransomware deployment. The broader intrusion involved likely exploitation of an exposed SQL or Microsoft SQL Server vulnerability, though brokered access has also been considered possible. Operators used DLL sideloading, account creation, firewall and security-setting changes, and multi-vector BYOVD-based defense evasion to preserve access and suppress security tooling. Backdoor.Turn itself supports remote command execution, process creation, internal network scanning, LDAP and Active Directory reconnaissance, credential-based lateral movement, browser credential theft, and collection of certificate-related information. It has also been observed injected into a legitimate process after ransomware deployment, suggesting use for persistence, post-encryption access retention, or resale of access.

The malware targets Windows environments and has been linked to highly sophisticated ransomware tradecraft emphasizing stealth, persistence, reconnaissance, credential theft, lateral movement, and post-compromise control in enterprise networks.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2025-61155Arbitrary Process Termination in Tower of Fantasy GameDriverX64.sysExploited in the wild

The drivers involved included Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud’s wsftprm.sys (CVE-2023-52271), Tower of Fantasy’s GameDriverx64.sys (CVE-2025-61155), and K7 Security’s K7RKScan.sys (CVE-2025-1055).

via help net securityhelpnetsecurity.com

CVE-2025-1055Improper Authorization in K7 Security K7RKScan.sys IOCTL HandlerExploited in the wild

via help net securityhelpnetsecurity.com

CVE-2023-52271Arbitrary Protected Process Termination in Topaz Antifraud wsftprm.sysExploited in the wild

via help net securityhelpnetsecurity.com

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

DragonForce

6월 공개된 Microsoft Teams 릴레이(TURN) 인프라를 악용해 C2(명령·제어) 트래픽을 은닉하는 'Backdoor.Turn' 사례입니다.

via alyac blogblog.alyac.co.kr

Scattered Spider

Операторы вымогательской группировки DragonForce начали использовать необычную тактику для маскировки своей активности... в одной из недавних атак хакеры использовали кастомный бэкдор Backdoor.Turn, который маскирует обмен данными с управляющим сервером под обычный трафик Microsoft Teams.

via xakepxakep.ru

Hackledorb

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

T1190Exploit Public-Facing ApplicationEvidence1

Ransomware operators continued to rely on a consistent set of Tactics, Techniques, and Procedures (TTPs), including exploitation of internet-facing edge devices and remote management tooling.

Persistence

2 techniques

T1078Valid AccountsEvidence1

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

T1136Create AccountEvidence1

This included removing the Limit Blank Password security setting to allow for easy access to the compromised machines, creating new user accounts to maintain or gain additional access

Privilege Escalation

4 techniques

T1055Process InjectionEvidence3

Backdoor.Turn был внедрен в процесс DbgView64.exe

T1068Exploitation for Privilege EscalationEvidence1

Ransomware operators continued to rely on a consistent set of Tactics, Techniques, and Procedures (TTPs), including exploitation of internet-facing edge devices and remote management tooling, abuse of valid accounts, credential theft, and the routine use of EDR-killer tooling and Bring Your Own Vulnerable Driver techniques ahead of impact.

T1078Valid AccountsEvidence1

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

T1548Abuse Elevation Control MechanismEvidence1

The attackers also deployed what, at the time of the attack, was as an undocumented vulnerability in a Huawei driver to help mask their activity.

Stealth

3 techniques

T1036MasqueradingEvidence2

маскирует обмен данными с управляющим сервером под обычный трафик Microsoft Teams

T1055Process InjectionEvidence3

Backdoor.Turn был внедрен в процесс DbgView64.exe

T1078Valid AccountsEvidence1

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

Credential Access

2 techniques

T1555Credentials from Password StoresEvidence5

These capabilities, combined with the capabilities of Backdoor.Turn – code execution, network scanning, credential-based lateral movement within the network and browser credential theft from compromised endpoints

T1649Steal or Forge Authentication CertificatesEvidence1

сбор TLS-сертификатов

Discovery

4 techniques

T1007System Service DiscoveryEvidence1

выполнение команд, запуск процессов

T1018Remote System DiscoveryEvidence2

поиск объектов LDAP и Active Directory

T1046Network Service DiscoveryEvidence4

T1482Domain Trust DiscoveryEvidence1

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence2

These capabilities, combined with the capabilities of Backdoor.Turn – code execution, network scanning, credential-based lateral movement within the network

Command and Control

5 techniques

T1071Application Layer ProtocolEvidence11

The cybercriminals used a Go-based Remote Access Trojan (RAT) to abuse Microsoft Teams' TURN relay servers and mask command-and-control traffic.

T1090ProxyEvidence2

It manually initiated WebRTC sessions using hijacked TURN credentials, tricking Microsoft's infrastructure into acting as a blind, trusted proxy for arbitrary C2 traffic.

T1090.002External ProxyEvidence3

Microsoft Teams 릴레이(TURN) 인프라를 악용해 C2(명령·제어) 트래픽을 은닉

T1090.003Multi-hop ProxyEvidence2

Backdoor.Turn was used to obtain an anonymous Teams visitor token from Microsoft’s Skype-backed identity services before using a legitimate Microsoft TURN relay to set up a connection.

T1572Protocol TunnelingEvidence2

использует протокол TURN (Traversal Using Relays around NAT)... использует легитимный TURN-релей для установки соединения, а затем открывает QUIC-сессию с настоящим управляющим сервером атакующих

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

the attackers were able to deploy DragonForce ransomware to exfiltrate data and encrypt the victim machines

Impact

1 technique

T1490Inhibit System RecoveryEvidence1

To help maintain persistence on the network the attackers altered configurations and systems. This included removing the Limit Blank Password security setting to allow for easy access to the compromised machines

Other

2 techniques

T1562Impair DefensesEvidence1

T1562.004Disable or Modify System FirewallEvidence1

and modifying firewall rules to facilitate remote access and ensure C&C communication remained unhindered.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app26 days ago

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

dragos blogNews

Aug 10, 2026

Industrial Ransomware Analysis for Q2 2026

A custom Go-based remote access trojan used by a DragonForce affiliate for covert command-and-control by tunneling traffic through Microsoft Teams TURN relay infrastructure.

alyac blogNews

Jul 8, 2026

2026년 2분기 랜섬웨어 동향보고서

Microsoft Teams TURN 인프라를 악용해 C2 트래픽을 정상 서비스 내부에 은닉함으로써 탐지를 회피하는 백도어 사례로 설명된다.

cyberflorida blogNews

Jun 30, 2026

DragonForce Ransomware Abuses Microsoft Teams for Covert C2 Operations | Cyber Florida at USF

A custom Go-based backdoor/RAT used to tunnel command-and-control traffic through Microsoft Teams/Skype TURN relay infrastructure by retrieving a visitor token, setting up a legitimate TURN relay, and establishing outbound QUIC/WebRTC-based encrypted C2 sessions for covert persistence.

xakepNews

Jun 19, 2026

Вымогатели используют серверы Microsoft Teams для сокрытия трафика - Хакер

Custom Go-based backdoor used by DragonForce that tunnels C2 communications through Microsoft Teams TURN infrastructure and QUIC sessions to disguise malicious traffic as legitimate Teams traffic. It supports command execution, process launching, network scanning, LDAP and Active Directory discovery, TLS certificate collection, and browser credential theft, likely to enable persistence and future re-entry after ransomware deployment.

+11 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Backdoor.Turn