DragonForce Ransomware Group Abuses Microsoft Teams to Conceal Malicious Traffic in US Firm Breach Cybercriminals tied to the DragonForce ransomware group compromised a US-based services firm in late 2025, leveraging a custom backdoor to hide their command-and-control (C2) traffic within Microsoft Teams’ relay infrastructure. Researchers from Broadcom’s Symantec and Carbon Black identified the attack, marking the first known instance of malware abusing Microsoft’s TURN relay to evade detection. ### The Attack: A Multi-Stage Intrusion The threat actors gained initial access in December 2025, likely through an unpatched SQL/MSSQL vulnerability or via an initial access broker. Once inside, they employed DLL sideloading, abusing a legitimate VirtualBox executable to load malicious code and bypass security tools. Over one to two months, the attackers: - Modified firewall rules and system settings to maintain persistence. - Disabled security defenses using bring-your-own-vulnerable-driver (BYOVD) techniques, exploiting flaws in drivers from Huawei (HWAudioOs2Ec.sys), Topaz Antifraud (CVE-2023-52271), Tower of Fantasy (CVE-2025-61155), and K7 Security Anti-Malware (CVE-2025-1055). - Deployed Abyss Worker, a malicious driver disguised as a Palo Alto Networks security component. - Used Havoc Process Terminator to further evade detection. The final phase involved data exfiltration and DragonForce ransomware deployment, along with the installation of Backdoor.Turn, a Go-based backdoor designed to blend C2 traffic with legitimate Microsoft Teams communications. By routing malicious traffic through Microsoft’s TURN relay servers, the attackers made their activity appear as routine business traffic, bypassing traditional security filters. ### A Shift in Ransomware Tactics Symantec and Carbon Black researchers described DragonForce’s evolution from a ransomware-as-a-service (RaaS) model to a highly organized cartel, employing custom tooling, advanced evasion techniques, and trusted cloud services to maintain persistence. Cybersecurity experts noted that this approach mirrors state-sponsored threat actor tradecraft, moving beyond opportunistic attacks to long-term, stealthy operations. The abuse of Microsoft Teams’ infrastructure highlights a growing trend where attackers exploit implicit trust in enterprise collaboration tools, making detection significantly harder. As one expert observed, security systems often whitelist traffic to Microsoft domains, allowing malicious activity to slip through undetected.