DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN Relays to Conceal Ransomware C2 (Go RAT, BYOVD, CVE-2023-52271 / CVE-2025-61155 / CVE-2025-1055)

DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN (TL-2026-0819), also tracked as Backdoor.Turn, is a high-severity malware campaign, first published 2026-06-16. It is attributed to DragonForce (Malaysia) with medium confidence, affects Microsoft Microsoft Teams TURN relay infrastructure (abused, not, references 3 CVEs (CVE-2023-52271, CVE-2025-61155, CVE-2025-1055), maps to 26 MITRE ATT&CK techniques (T1014, T1016, T1018), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-0819

Threat ID
TL-2026-0819
Also known as
Backdoor.Turn, Turn backdoor, DragonForce TURN-relay C2 campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-16
Last reviewed
2026-06-16
Attribution
DragonForce
Attribution confidence
MEDIUM
Nation-state nexus
Malaysia
Motivation
FINANCIAL
Target sectors
services, professional services, retail, managed service providers
Target regions
North America, United States
Detection rules
9
Indicators of compromise
21

Malware and tooling in DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN

Malware and tooling: Backdoor.Turn, Legitimate VirtualBox/DebugView (DbgView64.exe) used for DLL side-loading, Microsoft Teams TURN relay (legitimate, abused)

DragonForce deployed a custom Go-based RAT, Backdoor.Turn, that obtains an anonymous Microsoft Teams visitor token from a legitimate Microsoft TURN relay server to tunnel command-and-control traffic inside trusted Teams infrastructure flows. Symantec assesses this as the first known real-world malware abusing Microsoft Teams TURN relays for C2 evasion, observed in a December 2025 intrusion against a major U.S. services company that culminated in DragonForce ransomware deployment.

How DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN works

Symantec's Threat Hunter Team disclosed (reported 2026-06-16) a December 2025 intrusion against a major U.S. services company in which the DragonForce ransomware operation used a previously undocumented, custom Go-based remote access trojan that Symantec tracks as Backdoor.Turn. The defining novelty is the malware's command-and-control channel: Backdoor.Turn abuses the TURN (Traversal Using Relays around NAT) protocol that Microsoft Teams relies on to relay media and messages when a direct peer-to-peer client connection is not possible. The backdoor obtains an anonymous Teams 'visitor' token and uses a legitimate Microsoft TURN relay server during connection setup, so its C2 traffic is relayed through Microsoft-owned infrastructure and blends in with normal Teams activity. Symantec assesses this is the first time this technique has been observed in a real attack, operationalizing the 'Ghost Calls' TURN-credential-abuse concept that Praetorian's Adam Crosser publicly demonstrated at Black Hat USA in 2025.

Backdoor.Turn is a feature-rich RAT whose capabilities include arbitrary command execution, process creation, network scanning, TLS certificate capturing, LDAP/Active Directory searching, web page title collection, and browser credential theft. In the observed intrusion it was injected into DbgView64.exe (a legitimate Sysinternals DebugView binary) and, notably, was injected only after the ransomware had been deployed, suggesting it was intended to provide stealthy persistence or future re-access to the victim environment.

The broader attack chain combined living-off-the-land tooling with aggressive defense evasion. Initial access was assessed as likely exploitation of an unknown SQL/MSSQL server flaw. The actors then downloaded a ZIP containing a legitimate VirtualBox/DebugView executable and paired it with a malicious DLL for DLL side-loading, created rogue local user accounts, abused the LimitBlankPassword security policy, and modified Windows firewall rules. For defense evasion and privilege escalation the operators executed a Bring-Your-Own-Vulnerable-Driver (BYOVD) campaign using multiple signed-but-vulnerable kernel drivers to terminate endpoint security tooling: a Huawei driver HWAuidoOs2Ec.sys (used as a 'Havoc Process Terminator'), the Topaz Antifraud driver wsftprm.sys (CVE-2023-52271), the Tower of Fantasy anti-cheat driver GameDriverx64.sys (CVE-2025-61155), and the K7 Security driver K7RKScan.sys (CVE-2025-1055), alongside a custom malicious driver tracked as ABYSSWORKER that masqueraded as a Palo Alto Networks component. After reconnaissance and data exfiltration, DragonForce ransomware was deployed.

DragonForce has operated since at least 2023, adopted a cartel-style affiliate/white-label organizational model, and has been publicly linked to the Scattered Spider threat collective. Because the C2 channel rides legitimate Microsoft TURN relays, traditional network-based blocking of attacker infrastructure is largely ineffective; defenders must instead rely on host-based and behavioral indicators (anomalous services, process-injection artifacts, BYOVD driver loads) and on monitoring for Teams/relay traffic anomalies such as outgoing TCP connections to Microsoft IP ranges on non-standard ports.

MITRE ATT&CK techniques used in TL-2026-0819

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1078.003 Local Accounts

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1087.002 Domain Account

Exfiltration

T1041 Exfiltration Over C2 Channel

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1090.002 External Proxy; T1095 Non-Application Layer Protocol; T1102 Web Service; T1573.002 Asymmetric Cryptography

Execution

T1106 Native API; T1569.002 Service Execution

Persistence

T1136.001 Local Account; T1543.003 Windows Service

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop

Credential Access

T1555.003 Credentials from Web Browsers

stealth

T1574.001 DLL

defense-impairment

T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall

Affected products and versions in DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN

  • Microsoft — Microsoft Teams TURN relay infrastructure (abused, not vulnerable)
    Vulnerable versions: TURN relay service used for C2 relaying via anonymous visitor token
  • Topaz Systems — Topaz Antifraud wsftprm.sys kernel driver
    Vulnerable versions: 2.0.0.0
  • Hotta Studio — Tower of Fantasy GameDriverx64.sys anti-cheat driver
    Vulnerable versions: 7.23.4.7 and earlier
  • K7 Computing — K7 Security Anti-Malware K7RKScan.sys driver
    Vulnerable versions: affected versions per CVE-2025-1055
  • Huawei — HWAuidoOs2Ec.sys kernel driver (abused as process terminator)
    Vulnerable versions: signed driver abused via BYOVD

Remediation for DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN

Patches

  • Apply vendor updates/removals for vulnerable drivers: Topaz Antifraud (CVE-2023-52271), Hotta Studio Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), K7 Security K7RKScan.sys (CVE-2025-1055).
  • Patch the exploited public-facing SQL/MSSQL server once the specific flaw is identified.

Immediate actions

  • Hunt for any Windows service named 'TeamsMediaRelay' and investigate the backing binary and account context.
  • Investigate DbgView64.exe / Teams.exe processes for RWX (read-write-execute) memory pages and other process-injection artifacts.
  • Alert on outgoing TCP connections to Microsoft IP ranges on non-standard (non-Teams) ports and unexpected TURN/relay traffic from non-Teams processes.
  • Audit recently created local user accounts and revert any abuse of the LimitBlankPassword security policy.
  • Audit and revert anomalous modifications under HKLM\SYSTEM\CurrentControlSet\Services and unauthorized Windows firewall rule changes.

Workarounds

  • Block load of known-vulnerable driver hashes via application/driver allowlisting.
  • Where feasible, constrain Teams TURN relay egress to the Teams client process only.

Longer-term hardening

  • Deploy and enforce Microsoft Vulnerable Driver Blocklist (HVCI / WDAC) to block the abused BYOVD drivers (wsftprm.sys, GameDriverx64.sys, K7RKScan.sys, HWAuidoOs2Ec.sys).
  • Deploy EDR with kernel/driver-load telemetry and behavioral detection for security-tool termination and DLL side-loading.
  • Restrict and monitor outbound Teams/WebRTC TURN usage; baseline which processes legitimately use TURN relays.
  • Harden public-facing SQL/MSSQL servers (patching, least privilege, network segmentation) and monitor for exploitation.
  • Enforce strong password policy and disable blank-password logons via Group Policy.

CVEs associated with DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN

CVE-2023-52271, CVE-2025-61155, CVE-2025-1055

Weaknesses (CWE) in DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN

CWE-782, CWE-284, CWE-269

Timeline of DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN

  • DragonForce ransomware operation observed active, later adopting a cartel-style white-label affiliate model and links to the Scattered Spider collective.
  • CVE-2023-52271 disclosed for the Topaz Antifraud wsftprm.sys kernel driver, an arbitrary-process-termination flaw later weaponized in this BYOVD campaign to terminate endpoint security tooling.
  • CVE-2025-1055 published for the K7 Security K7RKScan.sys driver (IOCTL-driven arbitrary process termination), one of the signed-but-vulnerable drivers later abused in the intrusion.
  • DragonForce repositioned itself as a ransomware 'cartel' offering a white-label affiliate model, expanding its operational footprint amid broader RaaS-ecosystem disruption.
  • Praetorian researcher Adam Crosser publicly demonstrated the 'Ghost Calls' technique at Black Hat USA, showing how temporary Teams/Zoom TURN credentials can be hijacked to build covert C2 tunnels through trusted conferencing infrastructure.
  • CVE-2025-61155 disclosed for the Hotta Studio Tower of Fantasy GameDriverx64.sys anti-cheat driver, the third vulnerable signed driver later staged for BYOVD process termination.
  • DragonForce intrusion against a major U.S. services company; initial access assessed as likely exploitation of an unknown public-facing SQL/MSSQL server flaw.
  • Operators deployed DLL side-loading via a legitimate VirtualBox/DebugView binary, created rogue accounts, abused the LimitBlankPassword policy, modified firewall rules, and ran a BYOVD campaign (wsftprm.sys, GameDriverx64.sys, K7RKScan.sys, HWAuidoOs2Ec.sys, ABYSSWORKER) to terminate security tools.
  • Backdoor.Turn (custom Go RAT) was injected into DbgView64.exe after the ransomware deployment, establishing TURN-relay C2 via an anonymous Microsoft Teams visitor token for stealthy persistence / future access.
  • After reconnaissance and data exfiltration, DragonForce ransomware was deployed across the victim environment.
  • Symantec's Threat Hunter Team disclosed the campaign (reported via BleepingComputer), assessing Backdoor.Turn as the first known malware abusing Microsoft Teams TURN relays for C2 in a real-world attack, and published indicators of compromise.

Sources cited for DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN

Threats related to DragonForce 'Backdoor.Turn' Abuses Microsoft Teams TURN

Detection coverage for TL-2026-0819

As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0819 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats