Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

DragonForce hides malware in Microsoft Teams via custom backdoor

Part of the DragonForce story · since 9 Sep 2025

Quiet for 4 weekslast report 5 Oct19 articles8 outlets
9 Sep · SecurityWeek first6 Apr16 Jun26 AugNowThis article16th of 19
  • Tue 9 Sep, 11:00 UTC. SecurityWeek, first report. Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Thu 9 Oct, 06:45 UTC. GBHackers, its first report on the story. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise.
  • Wed 5 Nov, 05:41 UTC. GBHackers. DragonForce Cartel Surfaces from Leaked Conti v3 Ransomware Source Code.
  • Wed 5 Nov, 20:10 UTC. Darktrace, its first report on the story. Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace.
  • Fri 7 Nov, 00:55 UTC. SecurityOnline, its first report on the story. DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host.
  • Mon 10 Nov, 01:30 UTC. SecurityOnline. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access.
  • Mon 10 Nov, 10:25 UTC. GBHackers. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce.
  • Tue 11 Nov, 01:00 UTC. SecurityOnline. DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Mon 19 Jan, 02:30 UTC. SecurityOnline. DragonForce: The Rise of a New “Ransomware Cartel” Built on LockBit and Conti DNA.
  • Tue 16 Jun, 12:11 UTC. Infosecurity, its first report on the story. DragonForce Ransomware Exploited Microsoft Teams to Hide in Attack Against Major Company.
  • Wed 17 Jun, 10:46 UTC. SecurityWeek. DragonForce ransomware leverages Teams for new Backdoor.Turn C2.
  • Wed 17 Jun, 16:49 UTC. Security Affairs. DragonForce hides malware in Microsoft Teams via custom backdoor. This article, 16th of 19.
  • Thu 18 Jun, 14:01 UTC. The Hacker News. DragonForce hides ransomware C2 via Microsoft Teams relays.
  • Mon 22 Jun, 04:40 UTC. SecurityOnline. Symantec spots DragonForce Backdoor.Turn using Teams TURN relay.
  • Mon 5 Oct, 09:59 UTC. SecurityOnline. DragonForce Hides Ransomware Backdoors Inside Microsoft Teams Traffic.

DragonForce ransomware operators successfully hid malware within Microsoft Teams for one to two months, using a custom backdoor called Backdoor.Turn to mask their command-and-control traffic. This method involved obtaining a Teams visitor token and routing malicious traffic through legitimate Microsoft relay servers, evading detection. The attack, which exploited a potential SQL or MSSQL server vulnerability, allowed attackers to execute commands, lateral movement, and data theft.

DragonForce, active since 2023, has evolved into a sophisticated cybercrime cartel, employing advanced tactics such as custom-built drivers and the BYOVD (Bring Your Own Vulnerable Driver) technique.

How the story developed

All 19 articles
Quiet for 4 weekslast report 5 Oct19 articles8 outlets

19 articles from 8 outlets since 9 Sep. Quiet since 5 Oct. This was the 16th report, 281 days after the first.

Now9 Sep925112714311612 Jun1 OctFirst reportSecurityWeek · 9 Sep, 11:00This article16th of 19 · day 281Picked up againafter 4 weeks quiet
  • Tue 9 Sep, 11:00 UTC. SecurityWeek, first report. Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Thu 9 Oct, 06:45 UTC. GBHackers, its first report on the story. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise.
  • Wed 5 Nov, 05:41 UTC. GBHackers. DragonForce Cartel Surfaces from Leaked Conti v3 Ransomware Source Code.
  • Wed 5 Nov, 20:10 UTC. Darktrace, its first report on the story. Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace.
  • Fri 7 Nov, 00:55 UTC. SecurityOnline, its first report on the story. DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host.
  • Mon 10 Nov, 01:30 UTC. SecurityOnline. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access.
  • Mon 10 Nov, 10:25 UTC. GBHackers. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce.
  • Tue 11 Nov, 01:00 UTC. SecurityOnline. DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Mon 19 Jan, 02:30 UTC. SecurityOnline. DragonForce: The Rise of a New “Ransomware Cartel” Built on LockBit and Conti DNA.
  • Tue 16 Jun, 12:11 UTC. Infosecurity, its first report on the story. DragonForce Ransomware Exploited Microsoft Teams to Hide in Attack Against Major Company.
  • Wed 17 Jun, 10:46 UTC. SecurityWeek. DragonForce ransomware leverages Teams for new Backdoor.Turn C2.
  • Wed 17 Jun, 16:49 UTC. Security Affairs. DragonForce hides malware in Microsoft Teams via custom backdoor. This article, 16th of 19.
  • Thu 18 Jun, 14:01 UTC. The Hacker News. DragonForce hides ransomware C2 via Microsoft Teams relays.
  • Mon 22 Jun, 04:40 UTC. SecurityOnline. Symantec spots DragonForce Backdoor.Turn using Teams TURN relay.
  • Mon 5 Oct, 09:59 UTC. SecurityOnline. DragonForce Hides Ransomware Backdoors Inside Microsoft Teams Traffic.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Tue 9 SepDay 01
    1. Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations11:00 · SecurityWeek · First report

  2. Quiet for 4 weeks

    Wed 8 OctDay 293
    1. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem13:45 · The Hacker News · Picked up again
    2. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:20 · Security Affairs
    3. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:50 · DataBreaches
  3. Thu 9 OctDay 301
    1. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise06:45 · GBHackers

  4. Quiet for 4 weeks

    Wed 5 NovDay 572
    1. DragonForce Cartel Surfaces from Leaked Conti v3 Ransomware Source Code05:41 · GBHackers · Picked up again
    2. Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace20:10 · Darktrace
  5. Fri 7 NovDay 591
    1. DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host00:55 · SecurityOnline

  6. Quiet for 3 days

    Mon 10 NovDay 622
    1. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access01:30 · SecurityOnline · Picked up again
    2. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce10:25 · GBHackers
  7. Tue 11 NovDay 631
    1. DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase01:00 · SecurityOnline

  8. Quiet for 6 weeks

    Tue 23 DecDay 1051
    1. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit01:25 · SecurityOnline · Picked up again

  9. Quiet for 4 weeks

    Mon 19 JanDay 1321
    1. DragonForce: The Rise of a New “Ransomware Cartel” Built on LockBit and Conti DNA02:30 · SecurityOnline · Picked up again

  10. Quiet for 21 weeks

    Tue 16 JunDay 2801
    1. DragonForce Ransomware Exploited Microsoft Teams to Hide in Attack Against Major Company12:11 · Infosecurity · Picked up again
  11. Wed 17 JunDay 2812
    1. DragonForce ransomware leverages Teams for new Backdoor.Turn C210:46 · SecurityWeek
    2. DragonForce hides malware in Microsoft Teams via custom backdoor16:49 · Security Affairs · This article, 16th of 19
  12. Thu 18 JunDay 2821
    1. DragonForce hides ransomware C2 via Microsoft Teams relays14:01 · The Hacker News

  13. Quiet for 4 days

    Mon 22 JunDay 2861
    1. Symantec spots DragonForce Backdoor.Turn using Teams TURN relay04:40 · SecurityOnline · Picked up again

  14. Quiet for 15 weeks

    Mon 5 OctDay 3911
    1. DragonForce Hides Ransomware Backdoors Inside Microsoft Teams Traffic09:59 · SecurityOnline · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in