Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

DragonForce Ransomware Exploited Microsoft Teams to Hide in Attack Against Major Company

Part of the DragonForce story · since 9 Sep 2025

Quiet for 4 weekslast report 5 Oct19 articles8 outlets
9 Sep · SecurityWeek first6 Apr16 Jun26 AugNowThis article14th of 19
  • Tue 9 Sep, 11:00 UTC. SecurityWeek, first report. Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Thu 9 Oct, 06:45 UTC. GBHackers, its first report on the story. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise.
  • Wed 5 Nov, 05:41 UTC. GBHackers. DragonForce Cartel Surfaces from Leaked Conti v3 Ransomware Source Code.
  • Wed 5 Nov, 20:10 UTC. Darktrace, its first report on the story. Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace.
  • Fri 7 Nov, 00:55 UTC. SecurityOnline, its first report on the story. DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host.
  • Mon 10 Nov, 01:30 UTC. SecurityOnline. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access.
  • Mon 10 Nov, 10:25 UTC. GBHackers. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce.
  • Tue 11 Nov, 01:00 UTC. SecurityOnline. DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Mon 19 Jan, 02:30 UTC. SecurityOnline. DragonForce: The Rise of a New “Ransomware Cartel” Built on LockBit and Conti DNA.
  • Tue 16 Jun, 12:11 UTC. Infosecurity, its first report on the story. DragonForce Ransomware Exploited Microsoft Teams to Hide in Attack Against Major Company. This article, 14th of 19.
  • Wed 17 Jun, 10:46 UTC. SecurityWeek. DragonForce ransomware leverages Teams for new Backdoor.Turn C2.
  • Wed 17 Jun, 16:49 UTC. Security Affairs. DragonForce hides malware in Microsoft Teams via custom backdoor.
  • Thu 18 Jun, 14:01 UTC. The Hacker News. DragonForce hides ransomware C2 via Microsoft Teams relays.
  • Mon 22 Jun, 04:40 UTC. SecurityOnline. Symantec spots DragonForce Backdoor.Turn using Teams TURN relay.
  • Mon 5 Oct, 09:59 UTC. SecurityOnline. DragonForce Hides Ransomware Backdoors Inside Microsoft Teams Traffic.

A ransomware group, DragonForce, exploited Microsoft Teams to infiltrate a major U.S. services firm undetected for two months. They used a Go-based Remote Access Trojan (RAT), dubbed Backdoor.Turn, to hide command and control (C&C) traffic by masquerading as legitimate Microsoft Teams traffic. Their tactics included exploiting a vulnerability in a Huawei driver, altering system configurations, and creating new user accounts for ongoing access. The attackers focused on data exfiltration and system encryption. The incident exemplifies advanced cyber tradecraft, showcasing the sophistication of modern ransomware attacks.

How the story developed

All 19 articles
Quiet for 4 weekslast report 5 Oct19 articles8 outlets

19 articles from 8 outlets since 9 Sep. Quiet since 5 Oct. This was the 14th report, 280 days after the first.

Now9 Sep925112714311612 Jun1 OctFirst reportSecurityWeek · 9 Sep, 11:00This article14th of 19 · day 280Picked up againafter 4 weeks quiet
  • Tue 9 Sep, 11:00 UTC. SecurityWeek, first report. Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Thu 9 Oct, 06:45 UTC. GBHackers, its first report on the story. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise.
  • Wed 5 Nov, 05:41 UTC. GBHackers. DragonForce Cartel Surfaces from Leaked Conti v3 Ransomware Source Code.
  • Wed 5 Nov, 20:10 UTC. Darktrace, its first report on the story. Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace.
  • Fri 7 Nov, 00:55 UTC. SecurityOnline, its first report on the story. DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host.
  • Mon 10 Nov, 01:30 UTC. SecurityOnline. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access.
  • Mon 10 Nov, 10:25 UTC. GBHackers. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce.
  • Tue 11 Nov, 01:00 UTC. SecurityOnline. DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Mon 19 Jan, 02:30 UTC. SecurityOnline. DragonForce: The Rise of a New “Ransomware Cartel” Built on LockBit and Conti DNA.
  • Tue 16 Jun, 12:11 UTC. Infosecurity, its first report on the story. DragonForce Ransomware Exploited Microsoft Teams to Hide in Attack Against Major Company. This article, 14th of 19.
  • Wed 17 Jun, 10:46 UTC. SecurityWeek. DragonForce ransomware leverages Teams for new Backdoor.Turn C2.
  • Wed 17 Jun, 16:49 UTC. Security Affairs. DragonForce hides malware in Microsoft Teams via custom backdoor.
  • Thu 18 Jun, 14:01 UTC. The Hacker News. DragonForce hides ransomware C2 via Microsoft Teams relays.
  • Mon 22 Jun, 04:40 UTC. SecurityOnline. Symantec spots DragonForce Backdoor.Turn using Teams TURN relay.
  • Mon 5 Oct, 09:59 UTC. SecurityOnline. DragonForce Hides Ransomware Backdoors Inside Microsoft Teams Traffic.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Tue 9 SepDay 01
    1. Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations11:00 · SecurityWeek · First report

  2. Quiet for 4 weeks

    Wed 8 OctDay 293
    1. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem13:45 · The Hacker News · Picked up again
    2. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:20 · Security Affairs
    3. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:50 · DataBreaches
  3. Thu 9 OctDay 301
    1. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise06:45 · GBHackers

  4. Quiet for 4 weeks

    Wed 5 NovDay 572
    1. DragonForce Cartel Surfaces from Leaked Conti v3 Ransomware Source Code05:41 · GBHackers · Picked up again
    2. Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace20:10 · Darktrace
  5. Fri 7 NovDay 591
    1. DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host00:55 · SecurityOnline

  6. Quiet for 3 days

    Mon 10 NovDay 622
    1. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access01:30 · SecurityOnline · Picked up again
    2. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce10:25 · GBHackers
  7. Tue 11 NovDay 631
    1. DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase01:00 · SecurityOnline

  8. Quiet for 6 weeks

    Tue 23 DecDay 1051
    1. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit01:25 · SecurityOnline · Picked up again

  9. Quiet for 4 weeks

    Mon 19 JanDay 1321
    1. DragonForce: The Rise of a New “Ransomware Cartel” Built on LockBit and Conti DNA02:30 · SecurityOnline · Picked up again

  10. Quiet for 21 weeks

    Tue 16 JunDay 2801
    1. DragonForce Ransomware Exploited Microsoft Teams to Hide in Attack Against Major Company12:11 · Infosecurity · Picked up again · This article, 14th of 19
  11. Wed 17 JunDay 2812
    1. DragonForce ransomware leverages Teams for new Backdoor.Turn C210:46 · SecurityWeek
    2. DragonForce hides malware in Microsoft Teams via custom backdoor16:49 · Security Affairs
  12. Thu 18 JunDay 2821
    1. DragonForce hides ransomware C2 via Microsoft Teams relays14:01 · The Hacker News

  13. Quiet for 4 days

    Mon 22 JunDay 2861
    1. Symantec spots DragonForce Backdoor.Turn using Teams TURN relay04:40 · SecurityOnline · Picked up again

  14. Quiet for 15 weeks

    Mon 5 OctDay 3911
    1. DragonForce Hides Ransomware Backdoors Inside Microsoft Teams Traffic09:59 · SecurityOnline · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in