DragonForce Hid Malware C2 in Microsoft Teams TURN Relays

Symantec reported that the DragonForce ransomware operation used a custom Go-based backdoor, Backdoor.TURN, to hide command-and-control traffic inside Microsoft Teams TURN relay infrastructure during an intrusion at a major U.S. services company. Researchers said the attackers likely gained initial access in December 2025 by exploiting an unknown SQL or MSSQL server flaw or through an initial access broker, then used DLL sideloading, reconnaissance, credential theft, lateral movement, rogue account creation, and firewall changes while remaining undetected for as long as two months. The malware reportedly obtained an anonymous visitor token through Microsoft’s Skype-linked identity services, authenticated to Teams infrastructure, relayed traffic through TURN servers, and then established a QUIC session to the real C2 server.

The intrusion escalated through extensive defense evasion and privilege abuse, including Bring Your Own Vulnerable Driver techniques and use of multiple vulnerable or malicious drivers such as Huawei’s HWAuidoOs2Ec.sys and the custom Abyss Worker driver, alongside drivers tied to CVE-2023-52271, CVE-2025-61155, and CVE-2025-1055. Symantec said the operators used kernel-level access to disable security tools, stole data, and ultimately deployed DragonForce ransomware to encrypt the victim’s systems. Researchers described the campaign as the first known real-world abuse of Microsoft Teams TURN relays for covert C2 and published indicators of compromise to help defenders detect similar attacks.