Loading story…
DragonForce operators covertly infiltrated a major U.S. services company and maintained access for up to two months before deploying ransomware, using a Go-based remote access trojan known as Backdoor.Turn to disguise command-and-control traffic as legitimate Microsoft Teams activity. According to reporting from Symantec and others, the malware obtained an anonymous Teams visitor token through Microsoft identity services, leveraged a legitimate Teams TURN relay, and then established a QUIC session to attacker-controlled infrastructure, allowing outbound traffic to blend in with normal collaboration traffic.
The intrusion was reported to have begun with exploitation of an SQL or MSSQL server and progressed through account creation, firewall-rule changes, security-setting modifications, credential theft, lateral movement, and data exfiltration before encryption. Additional reporting on the attack chain described social-engineering and Microsoft Teams-based initial access patterns, while researchers also said the attackers used an undocumented Huawei driver flaw in a BYOVD-style evasion technique to weaken defenses and help reach high-value systems, including domain controller access.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-16, researchers publicly reported their investigation into the 2025 DragonForce intrusion, including the use of Backdoor.Turn to conceal command-and-control traffic within Microsoft Teams TURN relay traffic. The report characterized the operation as exceptionally sophisticated.
In March 2026, Huntress published details about the Huawei driver vulnerability that had been used by the attackers for evasion. The vulnerability had previously been undocumented at the time of the intrusion.
After dwelling in the environment for up to two months, the attackers used DragonForce ransomware to exfiltrate data and encrypt victim systems. The reporting noted no indication of whether the victim paid a ransom.
During the intrusion, the attackers deployed the Go-based Backdoor.Turn RAT, which hid command-and-control traffic inside legitimate Microsoft Teams TURN relay traffic and established QUIC connectivity to attacker infrastructure. They also used an undocumented Huawei driver vulnerability as part of a multi-vector BYOVD evasion approach while changing security settings, creating accounts, and modifying firewall rules to preserve access and move laterally.
In 2025, DragonForce operators infiltrated a major US services firm, likely by exploiting a vulnerability in an SQL or MSSQL server. The attackers maintained access for up to two months before the ransomware stage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcecertego.net
Open sourcesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec reported that the DragonForce ransomware operation used a custom Go-based backdoor, **Backdoor.TURN**, to hide command-and-control traffic inside Microsoft Teams `TURN` relay infrastructure during an intrusion at a major U.S. services company. Researchers said the attackers likely gained initial access in December 2025 by exploiting an unknown SQL or MSSQL server flaw or through an initial access broker, then used DLL sideloading, reconnaissance, credential theft, lateral movement, rogue account creation, and firewall changes while remaining undetected for as long as two months. The malware reportedly obtained an anonymous visitor token through Microsoft’s Skype-linked identity services, authenticated to Teams infrastructure, relayed traffic through `TURN` servers, and then established a `QUIC` session to the real C2 server. The intrusion escalated through extensive defense evasion and privilege abuse, including **Bring Your Own Vulnerable Driver** techniques and use of multiple vulnerable or malicious drivers such as Huawei’s `HWAuidoOs2Ec.sys` and the custom **Abyss Worker** driver, alongside drivers tied to `CVE-2023-52271`, `CVE-2025-61155`, and `CVE-2025-1055`. Symantec said the operators used kernel-level access to disable security tools, stole data, and ultimately deployed DragonForce ransomware to encrypt the victim’s systems. Researchers described the campaign as the first known real-world abuse of Microsoft Teams `TURN` relays for covert C2 and published indicators of compromise to help defenders detect similar attacks.
Jun 29, 2026
DragonForce affiliates sustained a broad ransomware and extortion campaign against UK organizations in May 2026, publicly naming seven UK victims on the group’s Tor leak site and posting 22 victims globally in a single day, including four UK firms. Reported victims spanned professional services, finance, logistics, construction, technology, and luxury retail, underscoring the group’s opportunistic targeting rather than a focus on one vertical. Helix International drew particular concern because of its role as a managed service provider with medium, large, and Fortune 500 clients, raising the risk of downstream compromise across customer environments. Public reporting and curated intrusion data tie DragonForce activity to exploitation of exposed remote access and internet-facing systems, including Ivanti Connect Secure, FortiOS, FortiProxy, SonicOS SSL-VPN, Apache Log4j, Microsoft SmartScreen, and SimpleHelp RMM vulnerabilities. Tooling observed in DragonForce-linked intrusions includes utilities for discovery, remote management, credential theft, defense evasion, LOLBAS abuse, and exfiltration, while affiliates have also been linked to **BYOVD** techniques to disable or bypass EDR and antivirus protections. Prior reporting further connected DragonForce affiliates attributed to **Scattered Spider** to attacks on major UK retailers including **M&S, Co-op, and Harrods**.
Jul 12, 2026
DragonForce, a ransomware group that has evolved into a self-described "ransomware cartel," has intensified its global operations, targeting organizations with advanced tactics and forming alliances with other cybercriminal collectives. Security researchers have detailed how DragonForce leverages vulnerable drivers such as `truesight.sys` and `rentdrv2.sys` to disable security software and has improved its encryption methods to address previously exploited vulnerabilities. The group, which began by using the LockBit 3.0 builder and later adopted a modified Conti v3 source code, now operates a ransomware-as-a-service (RaaS) model, offering affiliates a significant share of profits and customizable tools to attract new participants. Notably, DragonForce has collaborated with groups like Scattered Spider and has been linked to the compromise of major organizations, including a high-profile breach of Marks & Spencer. Recently, DragonForce claimed responsibility for a significant breach at Mobilelink USA, a major dealer for Cricket Wireless, exfiltrating 5.04 TB of data and threatening to leak sensitive information, including personally identifiable and financial data of millions of customers across 21 states. The group has also reportedly allied with other ransomware gangs such as Qilin and LockBit, and has taken over operations or leak sites from other ransomware groups like RansomHub, BlackLock, and Mamona. In 2025 alone, DragonForce has impacted at least 185 organizations, with most attacks occurring in the last six months, underscoring the growing threat posed by this increasingly organized and aggressive ransomware operation.
Jun 29, 2026