Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays to Stay Hidden

The DragonForce ransomware group, tracked by Symantec as Hackledorb, conducted a sophisticated attack against a U.S. services firm, leveraging custom malware and novel techniques to evade detection. The attackers used a Go-based backdoor named Backdoor.Turn, which abuses Microsoft Teams' TURN relay infrastructure to hide command-and-control (C2) traffic behind legitimate Microsoft domains. They also employed DLL sideloading, BYOVD techniques exploiting vulnerable signed drivers—including Huawei’s HWAuidoOs2Ec.sys—and modified system configurations for persistence and lateral movement before deploying the DragonForce ransomware payload.

AI-extracted · verify before operational use