Summary
The DragonForce ransomware group has been caught deploying a custom Go-based backdoor called “Backdoor.Turn” that abuses Microsoft Teams TURN (Traversal Using Relays around NAT) relay servers to disguise command-and-control communications as legitimate Teams traffic. This marks the first confirmed in-the-wild implementation of this technique, which was theorized by researchers in 2025 but had not been observed in actual attacks until now.
The malware obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, establishes a connection through a legitimate Microsoft TURN relay, and then runs a QUIC session to an attacker-controlled C2 server. This makes the malicious traffic virtually indistinguishable from normal Microsoft Teams communications on the wire, effectively bypassing network security controls.
Symantec and Carbon Black published their findings on June 16, revealing that DragonForce used this technique during an attack on a major U.S. services firm, maintaining network access for one to two months. Beyond C2 concealment, Backdoor.Turn provides code execution, network scanning, credential-based lateral movement, and browser credential theft capabilities.
Source
SecurityWeek — Microsoft Teams Relay Servers Abused in DragonForce Attack · Security Affairs — DragonForce Hid Inside Microsoft Teams
Commentary
This is a genuinely novel C2 technique and a significant escalation in ransomware operator tradecraft. Abusing Microsoft’s own infrastructure to relay C2 traffic is the kind of “living off the land” approach that makes detection extremely difficult — you can’t just block Microsoft Teams relay traffic without breaking legitimate collaboration. The QUIC tunneling layer adds another challenge for deep packet inspection.
For red teamers and threat emulation teams, this is worth studying closely. For defenders, the immediate question is whether your NDR and proxy solutions can distinguish between legitimate Teams relay traffic and this kind of abuse. Expect Microsoft to be under pressure to close the anonymous token acquisition path that makes this possible.