Loading story…
Symantec reported that the DragonForce ransomware operation used a custom Go-based backdoor, Backdoor.TURN, to hide command-and-control traffic inside Microsoft Teams TURN relay infrastructure during an intrusion at a major U.S. services company. Researchers said the attackers likely gained initial access in December 2025 by exploiting an unknown SQL or MSSQL server flaw or through an initial access broker, then used DLL sideloading, reconnaissance, credential theft, lateral movement, rogue account creation, and firewall changes while remaining undetected for as long as two months. The malware reportedly obtained an anonymous visitor token through Microsoft’s Skype-linked identity services, authenticated to Teams infrastructure, relayed traffic through TURN servers, and then established a QUIC session to the real C2 server.
The intrusion escalated through extensive defense evasion and privilege abuse, including Bring Your Own Vulnerable Driver techniques and use of multiple vulnerable or malicious drivers such as Huawei’s HWAuidoOs2Ec.sys and the custom Abyss Worker driver, alongside drivers tied to CVE-2023-52271, CVE-2025-61155, and CVE-2025-1055. Symantec said the operators used kernel-level access to disable security tools, stole data, and ultimately deployed DragonForce ransomware to encrypt the victim’s systems. Researchers described the campaign as the first known real-world abuse of Microsoft Teams TURN relays for covert C2 and published indicators of compromise to help defenders detect similar attacks.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In reporting on the intrusion, Symantec assessed that the increasingly sophisticated tradecraft was tied to Hackledorb, identifying it as the actor behind DragonForce. This attribution accompanied technical details on Backdoor.Turn and Microsoft Teams TURN relay abuse.
Symantec disclosed the campaign and published indicators of compromise to help defenders detect and block similar attacks. The report detailed the use of Backdoor.Turn, Teams TURN relay abuse, and BYOVD techniques in the DragonForce intrusion.
After reconnaissance, credential theft, lateral movement, and data theft, the attackers used vulnerable and malicious drivers to disable security tools and then deployed DragonForce ransomware to encrypt the victim's systems. The intrusion reportedly remained undetected for up to two months.
During the intrusion, the operators deployed the custom Go-based malware Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams TURN relay infrastructure. Symantec described this as the first known in-the-wild abuse of Microsoft Teams TURN relays for malware C2.
Symantec reported that a DragonForce ransomware intrusion against a major U.S. services company began in December 2025, likely through exploitation of an unknown SQL or MSSQL server vulnerability or via an initial access broker. The attackers then established persistence and began operating inside the environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcethehackernews.com
Open sourcehackread.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DragonForce operators covertly infiltrated a major U.S. services company and maintained access for up to two months before deploying ransomware, using a Go-based remote access trojan known as **Backdoor.Turn** to disguise command-and-control traffic as legitimate Microsoft Teams activity. According to reporting from Symantec and others, the malware obtained an anonymous Teams visitor token through Microsoft identity services, leveraged a legitimate Teams `TURN` relay, and then established a `QUIC` session to attacker-controlled infrastructure, allowing outbound traffic to blend in with normal collaboration traffic. The intrusion was reported to have begun with exploitation of an `SQL` or `MSSQL` server and progressed through account creation, firewall-rule changes, security-setting modifications, credential theft, lateral movement, and data exfiltration before encryption. Additional reporting on the attack chain described social-engineering and Microsoft Teams-based initial access patterns, while researchers also said the attackers used an undocumented Huawei driver flaw in a **BYOVD**-style evasion technique to weaken defenses and help reach high-value systems, including domain controller access.
Aug 11, 2026
DragonForce, a ransomware group that has evolved into a self-described "ransomware cartel," has intensified its global operations, targeting organizations with advanced tactics and forming alliances with other cybercriminal collectives. Security researchers have detailed how DragonForce leverages vulnerable drivers such as `truesight.sys` and `rentdrv2.sys` to disable security software and has improved its encryption methods to address previously exploited vulnerabilities. The group, which began by using the LockBit 3.0 builder and later adopted a modified Conti v3 source code, now operates a ransomware-as-a-service (RaaS) model, offering affiliates a significant share of profits and customizable tools to attract new participants. Notably, DragonForce has collaborated with groups like Scattered Spider and has been linked to the compromise of major organizations, including a high-profile breach of Marks & Spencer. Recently, DragonForce claimed responsibility for a significant breach at Mobilelink USA, a major dealer for Cricket Wireless, exfiltrating 5.04 TB of data and threatening to leak sensitive information, including personally identifiable and financial data of millions of customers across 21 states. The group has also reportedly allied with other ransomware gangs such as Qilin and LockBit, and has taken over operations or leak sites from other ransomware groups like RansomHub, BlackLock, and Mamona. In 2025 alone, DragonForce has impacted at least 185 organizations, with most attacks occurring in the last six months, underscoring the growing threat posed by this increasingly organized and aggressive ransomware operation.
Jun 29, 2026
DragonForce affiliates sustained a broad ransomware and extortion campaign against UK organizations in May 2026, publicly naming seven UK victims on the group’s Tor leak site and posting 22 victims globally in a single day, including four UK firms. Reported victims spanned professional services, finance, logistics, construction, technology, and luxury retail, underscoring the group’s opportunistic targeting rather than a focus on one vertical. Helix International drew particular concern because of its role as a managed service provider with medium, large, and Fortune 500 clients, raising the risk of downstream compromise across customer environments. Public reporting and curated intrusion data tie DragonForce activity to exploitation of exposed remote access and internet-facing systems, including Ivanti Connect Secure, FortiOS, FortiProxy, SonicOS SSL-VPN, Apache Log4j, Microsoft SmartScreen, and SimpleHelp RMM vulnerabilities. Tooling observed in DragonForce-linked intrusions includes utilities for discovery, remote management, credential theft, defense evasion, LOLBAS abuse, and exfiltration, while affiliates have also been linked to **BYOVD** techniques to disable or bypass EDR and antivirus protections. Prior reporting further connected DragonForce affiliates attributed to **Scattered Spider** to attacks on major UK retailers including **M&S, Co-op, and Harrods**.
Jul 12, 2026