MalwareUsed by 3 actorsExploits 3 CVEs

Backdoor.Turn

Backdoor.Turn is a custom Go-based remote access trojan associated with DragonForce ransomware intrusions. It is notable for concealing command-and-control communications inside Microsoft Teams TURN relay infrastructure, causing malicious traffic to resemble legitimate enterprise collaboration traffic. The malware obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to establish connectivity, and then initiates a QUIC-based session to attacker-controlled command-and-control infrastructure. This tradecraft has been assessed as the first known in-the-wild malware use of a Ghost Calls-style covert tunneling approach against Microsoft Teams relay services.

Backdoor.Turn has been observed in an intrusion against a major U.S. services firm in which DragonForce operators likely gained initial access through exploitation of an exposed SQL or Microsoft SQL Server vulnerability, although brokered access from an initial access broker has also been considered possible. During the intrusion, the operators used DLL sideloading, process injection, persistence measures, account creation, firewall and system configuration changes, and bring-your-own-vulnerable-driver techniques to disable security tooling and maintain access. The malware has been reported injected into a legitimate Windows process after ransomware deployment, suggesting use for continued covert access, possible re-entry, or resale of access after encryption.

Its supported functionality includes remote command execution, process creation, internal network scanning, LDAP and Active Directory enumeration, collection of TLS certificate information, credential-based lateral movement, and theft of browser-stored credentials. The malware therefore serves both post-compromise operational needs and long-term access objectives. Backdoor.Turn reflects a broader increase in sophistication among DragonForce-linked tooling and demonstrates how trusted cloud and collaboration infrastructure can be repurposed for stealthy command-and-control in ransomware operations.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2025-61155Arbitrary Process Termination in Tower of Fantasy GameDriverX64.sysExploited in the wild

The drivers involved included Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud’s wsftprm.sys (CVE-2023-52271), Tower of Fantasy’s GameDriverx64.sys (CVE-2025-61155), and K7 Security’s K7RKScan.sys (CVE-2025-1055).

via help net securityhelpnetsecurity.com

CVE-2025-1055Improper Authorization in K7 Security K7RKScan.sys IOCTL HandlerExploited in the wild

via help net securityhelpnetsecurity.com

CVE-2023-52271Arbitrary Protected Process Termination in Topaz Antifraud wsftprm.sysExploited in the wild

via help net securityhelpnetsecurity.com

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

DragonForce

6월 공개된 Microsoft Teams 릴레이(TURN) 인프라를 악용해 C2(명령·제어) 트래픽을 은닉하는 'Backdoor.Turn' 사례입니다.

via alyac blogblog.alyac.co.kr

Scattered Spider

Операторы вымогательской группировки DragonForce начали использовать необычную тактику для маскировки своей активности... в одной из недавних атак хакеры использовали кастомный бэкдор Backdoor.Turn, который маскирует обмен данными с управляющим сервером под обычный трафик Microsoft Teams.

via xakepxakep.ru

Hackledorb

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence2

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

T1190Exploit Public-Facing ApplicationEvidence1

The custom backdoor was used in an attack on a US services firm, which was likely compromised through an unknown vulnerability in an SQL or MSSQL server.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The backdoor enables threat actors to execute commands, create processes...

T1569.002Service ExecutionEvidence1

The backdoor enables threat actors to execute commands, create processes...

Persistence

1 technique

T1078Valid AccountsEvidence2

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence3

Backdoor.Turn был внедрен в процесс DbgView64.exe

T1068Exploitation for Privilege EscalationEvidence1

The observed attack against a U.S. services company in December 2025 involved exploiting an SQL server flaw, followed by privilege escalation using multiple vulnerable drivers (BYOVD) to disable security tools.

T1078Valid AccountsEvidence2

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

Stealth

3 techniques

T1036MasqueradingEvidence2

маскирует обмен данными с управляющим сервером под обычный трафик Microsoft Teams

T1055Process InjectionEvidence3

Backdoor.Turn был внедрен в процесс DbgView64.exe

T1078Valid AccountsEvidence2

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

Credential Access

2 techniques

T1555Credentials from Password StoresEvidence5

кражу учетных данных из браузеров

T1649Steal or Forge Authentication CertificatesEvidence1

сбор TLS-сертификатов

Discovery

5 techniques

T1007System Service DiscoveryEvidence1

выполнение команд, запуск процессов

T1018Remote System DiscoveryEvidence2

поиск объектов LDAP и Active Directory

T1046Network Service DiscoveryEvidence4

Функциональность нового бэкдора включает ... сканирование сети

T1082System Information DiscoveryEvidence1

When executed, the malicious vboxrt.dll downloads code from a list of servers, and that malicious code is used for numerous things, such as securing access, reconnaissance, and evading detection.

T1482Domain Trust DiscoveryEvidence2

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence10

Microsoft Teams 릴레이(TURN) 인프라를 악용해 C2(명령·제어) 트래픽을 은닉하는 'Backdoor.Turn' 사례

T1071.001Web ProtocolsEvidence1

Tracked as Backdoor.Turn, the newly identified malware is written in Go and hides its C&C server communication as legitimate Microsoft Teams traffic in a sophisticated manner. “Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to set up the connection, and then runs a QUIC session to the attacker’s real [C&C] server,”

T1090ProxyEvidence2

It manually initiated WebRTC sessions using hijacked TURN credentials, tricking Microsoft's infrastructure into acting as a blind, trusted proxy for arbitrary C2 traffic.

T1090.002External ProxyEvidence4

Microsoft Teams 릴레이(TURN) 인프라를 악용해 C2(명령·제어) 트래픽을 은닉

T1090.003Multi-hop ProxyEvidence1

“Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to set up the connection, and then runs a QUIC session to the attacker’s real command-and-control server.”

T1572Protocol TunnelingEvidence2

использует протокол TURN (Traversal Using Relays around NAT)... использует легитимный TURN-релей для установки соединения, а затем открывает QUIC-сессию с настоящим управляющим сервером атакующих

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

The Backdoor.Turn RAT was later deployed for persistence and data exfiltration before the final ransomware encryption.

Other

1 technique

T1562Impair DefensesEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app16 days ago

ACTIVITY FEED

Recent activity

13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

13 SOURCESView more in app

alyac blogNews

Jul 8, 2026

2026년 2분기 랜섬웨어 동향보고서

Microsoft Teams TURN 인프라를 악용해 C2 트래픽을 정상 서비스 내부에 은닉함으로써 탐지를 회피하는 백도어 사례로 설명된다.

cyberflorida blogNews

Jun 30, 2026

DragonForce Ransomware Abuses Microsoft Teams for Covert C2 Operations | Cyber Florida at USF

A custom Go-based backdoor/RAT used to tunnel command-and-control traffic through Microsoft Teams/Skype TURN relay infrastructure by retrieving a visitor token, setting up a legitimate TURN relay, and establishing outbound QUIC/WebRTC-based encrypted C2 sessions for covert persistence.

xakepNews

Jun 19, 2026

Вымогатели используют серверы Microsoft Teams для сокрытия трафика - Хакер

Custom Go-based backdoor used by DragonForce that tunnels C2 communications through Microsoft Teams TURN infrastructure and QUIC sessions to disguise malicious traffic as legitimate Teams traffic. It supports command execution, process launching, network scanning, LDAP and Active Directory discovery, TLS certificate collection, and browser credential theft, likely to enable persistence and future re-entry after ransomware deployment.

the hacker newsNews

Jun 18, 2026

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

A custom Go-based remote access trojan used to hide C2 traffic via Microsoft Teams TURN relay infrastructure. It obtains anonymous Teams visitor tokens, uses legitimate Microsoft TURN relays for connection setup, and then establishes a QUIC session to the real C2 server. It supports command execution, process creation, network scanning, LDAP and Active Directory search, credential-based lateral movement, and browser credential theft.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Backdoor.Turn