Reported by 2 outlets
DragonForce Ransomware Abuses Microsoft Teams TURN Relays for Stealth C2 — Backdoor.Turn Malware
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.20 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
DragonForce Ransomware Abuses Microsoft Teams TURN Relays for Stealth C2 — Backdoor.Turn Malware
bleepingcomputer.com · 120d ago · June 16th, 2026
DragonForce ransomware deployed Backdoor.Turn, a custom Go-based RAT that hides command-and-control traffic inside Microsoft Teams TURN relay infrastructure — the first known in-the-wild malware to abuse this technique. Symantec documented the attack against a major U.S. services company: the malware obtains an anonymous Teams visitor token, uses a legitimate Microsoft TURN relay during connection setup, then connects to the attacker's C2. Defenders see traffic associated with Microsoft Teams infrastructure. The attack also employed BYOVD techniques with drivers from Huawei, Topaz Antifraud, and K7 Security to obtain kernel privileges and terminate security tools. Capabilities include command execution, LDAP/AD search, TLS certificate capture, and browser credential theft.