DragonForce ransomware uses Microsoft Teams relays to hide C2

A sophisticated ransomware attack against a major U.S. services company has revealed a novel and stealthy technique for hiding malicious communications. Security researchers have confirmed that the DragonForce ransomware group used custom malware to disguise its command-and-control traffic as legitimate Microsoft Teams communications, marking the first known in-the-wild use of this method.

According to a report published by Symantec and Carbon Black, the attackers compromised the victim's network in December 2025, likely by exploiting an unknown vulnerability in an SQL or MSSQL server. Once inside, they deployed a custom Go-based remote access trojan, dubbed Backdoor.Turn. This malware uniquely abuses the Traversal Using Relays around NAT (TURN) protocol, a feature Microsoft Teams uses to relay audio and video traffic when direct connections are blocked.

Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft's identity services and uses a legitimate Microsoft TURN relay server to establish a connection. It then runs a QUIC session to the attackers' actual command-and-control server. As a result, network defenders and security tools only see outbound connections to...