DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic: A Deep Dive into Cyber Warfare
The world of cybersecurity is a complex and ever-evolving battlefield, and the latest threat actor to emerge from the shadows is DragonForce, a group with a penchant for sophisticated cyber tradecraft. In a recent incident, they have been observed exploiting Microsoft Teams relay infrastructure to conceal their command-and-control (C2) traffic, marking a significant advancement in their cyber operations.
What makes this attack particularly intriguing is the group's shift from a conventional ransomware-as-a-service (RaaS) model to a highly organized, formalized cartel structure. This transformation has led to the development of advanced techniques, with the deployment of Backdoor.Turn being a prime example of their evolving capabilities.
The Backdoor.Turn Technique
Backdoor.Turn, a custom Go-based remote access trojan (RAT), is designed to obtain an anonymous Teams visitor token from Microsoft's Skype-backed identity services. It then uses a legitimate Microsoft TURN relay to set up the connection, establishing a QUIC session to the attacker's real C2 server. This method allows the attackers to maintain a low profile, as the only traffic visible to network defenders is outbound connections to legitimate Microsoft Teams servers.
The threat hunter team at Symantec and Carbon Black, who first uncovered this technique, described it as a stealthy C2 communication method called Ghost Calls. This technique was documented by Praetorian in August 2024 and supports a wide range of capabilities, including command execution, process creation, network scanning, LDAP and Active Directory search, credential-based lateral movement, and browser credential theft.
The Attack Sequence
The attack sequence begins with the threat actors obtaining initial access to the victim network, often through a vulnerability in an SQL or MS-SQL server. Alternatively, they may acquire access through an initial access broker (IAB). Once inside, they initiate malicious activity by running a PowerShell command to drop a ZIP archive, disguised as a tech support hotfix.
This ZIP file contains a DLL side-loading attack, which then runs a rogue DLL to conduct reconnaissance, set up persistence, and silence security software using a Huawei driver (HWAuidoOs2Ec.sys). This is achieved through a technique called bring your own vulnerable driver (BYOVD), which has been used in large-scale malvertising campaigns targeting U.S.-based individuals searching for tax-related documents.
The Drivers Used
The attackers have employed several drivers for this purpose, including wsftprm.sys (CVE-2023-52271), GameDriverX64.sys (CVE-2025-61155), K7RKScan.sys (CVE-2025-1055), and ABYSSWORKER, a custom-built malicious driver previously observed in Medusa ransomware attacks.
Maintaining Access and Future Implications
What's notable about this attack is the execution of Backdoor.Turn by injecting it into the legitimate DbgView64.exe process after the DragonForce ransomware has been deployed. This suggests an attempt to maintain continued access to the compromised host for later attacks or reselling it for profit.
The use of Backdoor.Turn and the BYOVD evasion technique showcases the threat actors' ability to adapt and evolve their cyber operations, making them one of the most capable and persistent ransomware groups operating today. This incident highlights the importance of staying vigilant and implementing robust cybersecurity measures to protect against such sophisticated attacks.
As the cybersecurity landscape continues to evolve, it is crucial for organizations to stay informed about emerging threats and adapt their defenses accordingly. The DragonForce group's use of Microsoft Teams relay infrastructure to conceal their C2 traffic is a stark reminder of the need for constant vigilance and innovation in the field of cybersecurity.
