Summary
Researchers at Broadcom’s Symantec and Carbon Black have uncovered a sophisticated new technique used by the DragonForce ransomware group: hiding command-and-control communications inside Microsoft Teams relay infrastructure. The custom Go-based RAT, dubbed “Backdoor.Turn,” obtains an anonymous Microsoft Teams visitor token and routes all C2 traffic through Microsoft’s legitimate TURN (Traversal Using Relays around NAT) relay servers before connecting to the attacker’s actual C2 endpoint.
The technique was deployed against a major U.S. services firm, where the attackers maintained access for one to two months undetected. Network defenders only saw outbound connections to trusted Microsoft Teams servers — the malicious traffic was indistinguishable from legitimate Teams communications. This is the first publicly documented case of malware abusing TURN relay infrastructure in this manner.
Initial access is believed to have come from exploiting a vulnerability in an SQL/MSSQL server, or possibly purchased from an initial access broker. Post-compromise, the attackers used DLL side-loading, BYOVD techniques to disable security software, and deployed Backdoor.Turn to maintain persistent access even after ransomware deployment — suggesting an intent to resell access or return for future attacks.
Source
The Hacker News | Broadcom/Symantec Threat Intelligence | SecurityWeek
Commentary
This is a textbook example of “living off the land” taken to its logical extreme — abusing trusted cloud infrastructure to make malicious traffic invisible to network monitoring. By tunneling through Microsoft’s own TURN relays, the C2 traffic blends perfectly with legitimate Teams communications. Most SOCs don’t scrutinize outbound connections to Microsoft’s IP ranges, which makes this incredibly difficult to detect with traditional network-based security tools.
The implications are serious for any organization relying on network perimeter monitoring as a primary detection layer. When attackers can hide behind the same trusted infrastructure your employees use every day, detection has to shift to endpoint behavior, authentication anomalies, and deeper application-layer inspection. Expect to see copycats — this technique is too effective to remain exclusive to DragonForce for long.