DragonForce ransomware hides C2 traffic via Microsoft Teams

In December 2025, the DragonForce ransomware operation targeted a major U.S. services company using a novel technique to evade detection. The group deployed custom malware that leverages Microsoft Teams’ relay infrastructure to hide its command-and-control (C2) traffic, making malicious communications appear as legitimate Teams network activity. This marks the first documented case of malware abusing Teams’ Traversal Using Relays around NAT (TURN) protocol in the wild, according to cybersecurity firm Symantec.

How the attack unfolded

The intrusion began with the exploitation of an undisclosed vulnerability in an SQL or MSSQL server, though Symantec did not specify the exact flaw. Once inside the network, attackers downloaded a ZIP archive containing a legitimate VirtualBox/DbgView executable alongside a malicious DLL file, which was used to sideload the payload. This initial access was followed by a series of steps to establish persistence, including the creation of rogue user accounts, manipulation of Windows security policies to allow blank passwords, and modification of firewall rules to facilitate lateral movement.

To escalate privileges and disable security tools, the attackers employed a "Bring Your Own Vulnerable Driver" (BYOVD) tactic. They leveraged multiple drivers with known vulnerabilities, including Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud’s wsftprm.sys (CVE-2023-52271), Tower of Fantasy’s GameDriverx64.sys (CVE-2025-61155), and K7 Security’s K7RKScan.sys (CVE-2025-1055). Additionally, they deployed ABYSSWORKER, a custom malicious driver disguised as a legitimate Palo Alto driver, to further evade detection.

The core of the attack involved the deployment of Backdoor.Turn, a Go-based remote access trojan (RAT) injected into the DbgView64.exe process. The malware obtained an anonymous Teams visitor token and used a legitimate Microsoft TURN relay server to establish communication with its C2 infrastructure. By routing traffic through Teams’ relay servers, the attackers ensured that malicious activity blended seamlessly with normal network traffic, complicating detection efforts. Backdoor.Turn’s capabilities included command execution, process creation, network scanning, TLS certificate capture, LDAP and Active Directory reconnaissance, website title collection, and browser credential theft.

After completing reconnaissance and disabling security measures, the attackers exfiltrated data and deployed DragonForce ransomware to encrypt the victim’s systems. Symantec described the tradecraft used in this campaign as "exceptionally sophisticated," highlighting the group’s ability to combine multiple evasion techniques to bypass defenses.

Why this technique matters

The abuse of Microsoft Teams’ TURN relays represents a significant evolution in ransomware tactics. TURN protocols are designed to facilitate communication in scenarios where direct connections are impossible, such as when clients are behind firewalls or NAT devices. By exploiting this infrastructure, DragonForce effectively turned a trusted collaboration tool into a covert channel for C2 communications. This approach mirrors a proof-of-concept technique called "Ghost Calls," demonstrated by security firm Praetorian in 2025, which showed how temporary TURN credentials for Teams and Zoom could be hijacked to create stealthy communication tunnels.

The attack also underscores the growing trend of ransomware groups adopting cartel-style organizational structures, as seen with DragonForce’s alleged ties to the Scattered Spider threat group. This collaboration allows for the sharing of tools, techniques, and infrastructure, increasing the sophistication and scale of attacks. Symantec has published a list of indicators of compromise (IoCs) to aid defenders in detecting and blocking similar threats.

What to watch

The abuse of collaboration platforms like Microsoft Teams for C2 communications is likely to become more prevalent, given the success of this attack. Security researchers and vendors will need to develop new detection methods to identify malicious traffic masquerading as legitimate application data. Additionally, the use of BYOVD tactics highlights the ongoing challenge of securing third-party drivers, which often lack the same level of scrutiny as operating system components. Organizations should prioritize patching known vulnerable drivers and implementing strict driver allowlisting policies to prevent such attacks.