Back Scworld

DragonForce ransomware uses Microsoft Teams for covert command and control

Scworld • June 16, 2026

As reported by Bleeping Computer, DragonForce ransomware has been observed using a novel technique to hide its command-and-control (C2) traffic by routing it through Microsoft Teams' relay infrastructure.

The DragonForce ransomware operation, active since 2023 and linked to the Scattered Spider threat group, has employed custom Go-based malware dubbed "Backdoor.Turn". This malware abuses the Traversal Using Relays around NAT (TURN) protocol, which Microsoft Teams uses for message relay when direct connections fail. By obtaining an anonymous Teams visitor token and using legitimate Microsoft TURN relays, attackers can mask their C2 communications as normal Teams traffic, making detection significantly harder for defenders. This tactic was first conceptualized in 2025 by Praetorian with the "Ghost Calls" technique but Backdoor.Turn is the first known malware to implement it in the wild.

The observed attack against a U.S. services company in December 2025 involved exploiting an SQL server flaw, followed by privilege escalation using multiple vulnerable drivers (BYOVD) to disable security tools. The Backdoor.Turn RAT was later deployed for persistence and data exfiltration before the final ransomware encryption. Researchers noted the attackers' sophisticated methods and have provided indicators of compromise.

Source: Bleeping Computer

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DragonForce Ransomware Exploits Microsoft Teams for Covert C2 Communications The DragonForce ransomware group has been observed using a custom malware, Backdoor.Turn, to conceal command-and-control (C&C) traffic within Microsoft Teams' relay infrastructure. This sophisticated technique allows attackers to mask their communications as legitimate Microsoft traffic, making detection difficult for network defenders. The attack targeted a major U.S. services firm, with the intrusion beginning in December 2025 after exploiting an SQL or MSSQL server vulnerability. The attackers maintained access for one to two months, utilizing a combination of Bring Your Own Vulnerable Driver (BYOVD) techniques and DLL hijacking to evade security measures. The malware was designed to obtain an anonymous Teams visitor token and establish a QUIC session to the attacker's C2 server. Researchers from Symantec have confirmed this is the first known instance of malware abusing Microsoft Teams' TURN infrastructure for such purposes. The incident highlights the evolving tactics of ransomware groups and the need for enhanced security measures against such sophisticated threats. 13 sources 70

Extracted Entities

DragonForce ransomware uses Microsoft Teams for covert command and control

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)

Ransomware Groups (1)

Tools (1)