DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic: A Deep Dive into the Attack Vector
The recent discovery of DragonForce hackers exploiting Microsoft Teams relays to conceal their command-and-control (C2) traffic has raised significant concerns in the cybersecurity community. This sophisticated attack vector showcases the evolving tactics employed by threat actors, highlighting the need for organizations to stay vigilant and adapt their security measures accordingly.
The Attack Unveiled
In a detailed report, Symantec and Carbon Black revealed that the DragonForce ransomware group deployed a custom Go-based remote access trojan (RAT) named Backdoor.Turn. This backdoor leverages Microsoft's Traversal Using Relays around NAT (TURN) infrastructure to establish a covert connection to the attackers' C2 server.
What makes this attack particularly insidious is the use of Microsoft Teams relays. By obtaining an anonymous Teams visitor token, the backdoor sets up a legitimate Microsoft TURN relay connection. This relay server then facilitates the transfer of data between the victim's network and the attackers' C2 server, all while appearing as legitimate Microsoft Teams traffic to network defenders.
The Initial Breach
The attack chain began with the threat actors gaining initial access to the victim's network, likely through a vulnerability in an SQL or MS-SQL server. They initiated the breach in December 2025 by deploying a PowerShell command that dropped a ZIP archive, posing as a tech support hotfix. This ZIP file executed a DLL side-loading attack, leading to the installation of a rogue DLL.
The rogue DLL, named 'HWAuidoOs2Ec.sys', a Huawei driver, was instrumental in silencing security software and establishing persistence on the victim's system. This driver, along with others like wsftprm.sys, GameDriverX64.sys, and K7RKScan.sys, were previously observed in large-scale malvertising campaigns targeting U.S.-based individuals searching for tax-related documents.
Stealth and Persistence
One of the most concerning aspects of this attack is the execution of Backdoor.Turn by injecting it into the legitimate 'DbgView64.exe' process after the DragonForce ransomware deployment. This strategy suggests the hackers' intent to maintain prolonged access to the compromised host for future attacks or reselling purposes.
Backdoor.Turn employs a stealthy C2 communication technique called Ghost Calls, which was documented by Praetorian in 2024. This mechanism allows the backdoor to establish outbound connectivity while remaining hidden from network defenders. The backdoor's capabilities include command execution, process creation, network scanning, LDAP and Active Directory search, credential-based lateral movement, and browser credential theft.
The Evolving Threat Landscape
The DragonForce ransomware group's shift from a conventional ransomware-as-a-service (RaaS) model to a highly organized, formalized cartel structure is a significant development. This transformation is evident in their continuous capability development and the adoption of advanced techniques, making them one of the most persistent and capable ransomware groups today.
Implications and Recommendations
This attack highlights the importance of network visibility and the need for organizations to implement robust security measures. The ability to detect and respond to such sophisticated attacks is crucial in mitigating the impact of cyber threats. Organizations should focus on:
- Enhancing network segmentation to limit the lateral movement of attackers.
- Implementing advanced threat detection and response solutions.
- Regularly updating and patching systems to address known vulnerabilities.
- Conducting comprehensive security awareness training for employees.
In conclusion, the DragonForce hackers' abuse of Microsoft Teams relays to conceal their C2 traffic is a stark reminder of the ever-evolving nature of cyber threats. Organizations must remain vigilant, proactive, and adaptable in their security strategies to effectively counter these sophisticated attacks.
