Back Feeds2.Feedburner

Cybercriminals mask malicious communications through Microsoft Teams relays

Feeds2.Feedburner •Sinisa Markovic • June 16, 2026

The DragonForce ransomware group used a custom malware called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams relay infrastructure during an intrusion at a U.S. services company, according to Symantec. DragonForce is a ransomware-as-a-service operation that has been active since 2023. The group provides affiliates with ransomware tools and supporting services in exchange for a of ransom payments. First known abuse of Microsoft Teams TURN infrastructure “Backdoor.Turn obtains an anonymous Teams visitor token from … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DragonForce Ransomware Exploits Microsoft Teams for Covert C2 Communications The DragonForce ransomware group has been observed using a custom malware, Backdoor.Turn, to conceal command-and-control (C&C) traffic within Microsoft Teams' relay infrastructure. This sophisticated technique allows attackers to mask their communications as legitimate Microsoft traffic, making detection difficult for network defenders. The attack targeted a major U.S. services firm, with the intrusion beginning in December 2025 after exploiting an SQL or MSSQL server vulnerability. The attackers maintained access for one to two months, utilizing a combination of Bring Your Own Vulnerable Driver (BYOVD) techniques and DLL hijacking to evade security measures. The malware was designed to obtain an anonymous Teams visitor token and establish a QUIC session to the attacker's C2 server. Researchers from Symantec have confirmed this is the first known instance of malware abusing Microsoft Teams' TURN infrastructure for such purposes. The incident highlights the evolving tactics of ransomware groups and the need for enhanced security measures against such sophisticated threats. 11 sources 70

Extracted Entities

Cybercriminals mask malicious communications through Microsoft Teams relays

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Ransomware Groups (1)

Tools (1)