DRAGONFORCE ransomware operators have been seen using Microsoft Teams relay servers to hide their command‑and‑control traffic, allowing them to stay inside a US services firm for up to two months without detection. The attackers deployed a custom backdoor known as Backdoor.Turn, which authenticates as a legitimate Teams visitor and then routes malicious data through the platform’s TURN infrastructure. By abusing a trusted communications channel, the group reduced the likelihood that traditional security tools would flag the activity as suspicious. This approach reflects a shift towards living‑off‑the‑land tactics that leverage legitimate services for stealth.
Backdoor.Turn is written in the Go programming language and functions as a Remote Access Trojan that first obtains a visitor token from Microsoft Teams. Once the token is in hand, the malware establishes a connection to the Traversal Using Relays around NAT (TURN) service, which is normally used to relay audio and video streams for Teams calls. The resulting traffic appears identical to legitimate video‑call packets, letting the attackers issue commands, download additional payloads and exfiltrate data while blending in with normal user activity. No CVE has been assigned to this backdoor, underlining that the threat stems from misuse of authorized features rather than an unpatched vulnerability.
Investigators believe the initial foothold was gained either through an SQL injection against a backend database or by leveraging compromised broker credentials. After gaining entry, the attackers side‑loaded a malicious DLL via a trusted application, a technique that bypasses many application‑control policies. They then modified network security rules, exploited a known flaw in a Huawei driver and created several new local accounts to ensure continued access. These steps gave the DragonForce team the ability to run commands, move laterally and stage the eventual ransomware payload.
DragonForce operates out of Malaysia and has been active since 2023, steadily developing a reputation for using bespoke tools and advanced evasion methods such as the Bring Your Own Vulnerable Driver (BYOVD) approach. In this particular incident the group kept the Backdoor.Turn implant active for between one and eight weeks, using the Teams relay to issue commands, collect credentials and prepare the victim network for encryption. The prolonged dwell time highlights how abuse of legitimate services can delay detection and increase the potential impact of a ransomware attack. Researchers note that the combination of custom malware and trusted‑service abuse represents a growing trend among ransomware affiliates.
Because the malicious traffic mimics legitimate Teams sessions, standard firewalls and intrusion‑prevention systems often fail to raise an alarm, making behavioural monitoring a necessity. Defenders should watch for anomalies such as a user account requesting a Teams visitor token outside of normal working hours or a process that repeatedly contacts TURN servers without a corresponding audio or video stream. Correlating these signs with unusual DLL loads or unexpected privileged‑account creation can help reveal the presence of a hidden backdoor before the ransomware stage is reached.
Organisations should enforce application‑control policies that block unsigned or unsigned‑looking DLLs from being loaded by legitimate executables, while also limiting the use of visitor tokens to approved devices and times. Monitoring outbound TURN connections for volume or timing that deviates from expected usage patterns can catch covert channels early. Keeping third‑party drivers, especially those from hardware vendors, up to date reduces the chance that a vulnerable driver can be abused for persistence.
Finally, restricting the creation of new local accounts and enforcing multi‑factor authentication on privileged services makes it harder for attackers to maintain a foothold.