DragonForce Ransomware Abuses Microsoft Teams TURN Relays to Hide Backdoor.Turn C2 Traffic
DragonForce Ransomware Abuses Microsoft Teams TURN Relays to (TL-2026-2181) is a critical-severity ransomware operation, first published 2026-06-16. It is attributed to DragonForce (Malaysia) with high confidence, affects Topaz Evolution Antifraud (wsftprm.sys kernel driver), references 3 CVEs (CVE-2023-52271, CVE-2025-61155, CVE-2025-1055), maps to 15 MITRE ATT&CK techniques (T1021, T1027, T1036.005), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-2181
- Threat ID
- TL-2026-2181
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-06-16
- Last reviewed
- 2026-06-16
- Attribution
- DragonForce
- Attribution confidence
- HIGH
- Nation-state nexus
- Malaysia
- Motivation
- FINANCIAL
- Target sectors
- professional services
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in DragonForce Ransomware Abuses Microsoft Teams TURN Relays to
Malware and tooling: Backdoor.Turn, DragonForce, ransombay, ABYSSWORKER
Symantec's Broadcom Threat Hunter Team identified Backdoor.Turn, a Go-based backdoor deployed by the DragonForce ransomware cartel (tracked as Hackledorb), that abuses legitimate Microsoft Teams TURN relay infrastructure to conceal C2 traffic. Deployed during a 1-2 month intrusion at a U.S. services firm, the backdoor obtains an anonymous Teams visitor token, routes through a genuine Microsoft TURN relay, and then opens a direct QUIC session to the real C2 server before the DragonForce ransomware payload is dropped.
How DragonForce Ransomware Abuses Microsoft Teams TURN Relays to works
Symantec/Broadcom's Threat Hunter Team documented an intrusion at a U.S. services firm in which the DragonForce ransomware cartel (the group Symantec tracks internally as Hackledorb) maintained access for one to two months before deploying its ransomware payload. Initial access is suspected to involve exploitation of an internet-facing SQL or Microsoft SQL Server, or purchase of existing access from an initial access broker; the exact entry point was not conclusively determined. In December 2025 the operators executed PowerShell commands to retrieve a ZIP archive disguised as a tech-support hotfix ('TechSupV18Fix3.zip') from 192.36.27.51, then used DLL side-loading of a legitimate VirtualBox/DbgView64.exe binary paired with a malicious 'vboxrt.dll' to run reconnaissance and evasion code.
The attackers escalated defense evasion using a bring-your-own-vulnerable-driver (BYOVD) chain: three previously known vulnerable, signed kernel drivers (Topaz Antifraud wsftprm.sys / CVE-2023-52271, Tower of Fantasy GameDriverX64.sys / CVE-2025-61155, and K7 Security K7RKScan.sys / CVE-2025-1055) were abused to terminate protected security processes via crafted IOCTL requests, alongside a novel abuse of a Huawei HWAuidoOs2Ec.sys driver (documented publicly by Huntress only in March 2026, after this intrusion) and ABYSSWORKER -- a custom malicious driver, signed with likely-stolen certificates, that masquerades as a CrowdStrike Falcon driver and was first documented powering Medusa ransomware EDR-killing attacks.
The centerpiece of the intrusion is Backdoor.Turn, a Go-based remote access backdoor injected into the legitimate DbgView64.exe process. Backdoor.Turn requests an anonymous Microsoft Teams visitor token from Microsoft's Skype-backed identity services, uses that token to obtain credentials for a legitimate Microsoft TURN (Traversal Using Relays around NAT) relay server, and then tunnels a direct QUIC session to the attacker's real C2 server through that relay. Because the only traffic a network defender observes is an outbound connection to genuine Microsoft Teams/Skype infrastructure, the technique conceals the true C2 channel entirely within trusted collaboration-platform traffic. Symantec states this is the first known in-the-wild abuse of TURN relay infrastructure for C2 in this manner; the approach mirrors 'Ghost Calls,' a WebRTC/TURN-tunneling C2 technique against Zoom, Teams, and Google Meet publicly presented by Praetorian researcher Adam Crosser (open-sourced as the 'TURNt' tool) at Black Hat USA. Backdoor.Turn supports command execution, process creation, network/TLS-certificate/web-title scanning, LDAP and Active Directory searching, credential-based lateral movement, and browser credential theft.
For persistence and further defense evasion, the operators modified the LimitBlankPassword registry setting, created local backdoor accounts, and altered host firewall rules to permit their C2 communications. After roughly one to two months of dwell time, DragonForce deployed its ransomware payload, encrypting and exfiltrating victim data. DragonForce, active since June 2023, has since March 2025 operated as a formalized ransomware 'cartel' offering white-label branding to affiliates under its 'Ransom Bay' program, and by August-September 2025 had announced coordination partnerships with LockBit and Qilin -- evidence Symantec cites of the group's growing organizational maturity and technical sophistication.
MITRE ATT&CK techniques used in TL-2026-2181
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1574.001 DLL
Discovery
T1046 Network Service Discovery; T1087.002 Domain Account
Execution
Command and Control
T1090.002 External Proxy; T1573 Encrypted Channel
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
Affected products and versions in DragonForce Ransomware Abuses Microsoft Teams TURN Relays to
- Topaz Evolution — Antifraud (wsftprm.sys kernel driver)
Vulnerable versions: 2.0.0.0 and prior
Fixed in: not publicly specified - Hotta Studio — Tower of Fantasy (GameDriverX64.sys kernel driver)
Vulnerable versions: 7.23.4.7 and prior
Fixed in: not publicly specified - K7 Security — K7 Security Anti-Malware (K7RKScan.sys kernel driver)
Vulnerable versions: prior to 23.0.0.10
Fixed in: 23.0.0.10 - Huawei — HWAuidoOs2Ec.sys kernel driver
Vulnerable versions: novel BYOVD abuse documented by Huntress March 2026, no public patch identified in sources - Microsoft — Microsoft Teams / Skype TURN relay infrastructure (abused as a covert channel, not itself vulnerable)
Remediation for DragonForce Ransomware Abuses Microsoft Teams TURN Relays to
Patches
- Update Topaz Antifraud beyond the vulnerable wsftprm.sys 2.0.0.0 (CVE-2023-52271)
- Update Tower of Fantasy's GameDriverX64.sys beyond v7.23.4.7 (CVE-2025-61155)
- Update K7 Security Anti-Malware to K7RKScan.sys 23.0.0.10 or later (CVE-2025-1055)
Immediate actions
- Monitor and alert on Microsoft Teams/Skype TURN relay traffic originating from non-interactive, headless, or unexpected processes rather than the Teams client itself
- Hunt for DbgView64.exe or VirtualBox binaries running from non-standard install paths alongside unexpected companion DLLs such as vboxrt.dll
- Block/deny-list the known vulnerable driver files by hash and name (wsftprm.sys, GameDriverX64.sys, K7RKScan.sys, HWAuidoOs2Ec.sys, ABYSSWORKER/smuol.sys) via Microsoft's vulnerable driver blocklist (WDAC/HVCI)
- Block outbound traffic to the identified C2 IP (62.164.177.25) and C2/distribution domains, and alert on retrieval of archives named similarly to TechSupV18Fix3.zip
Workarounds
- Restrict or closely monitor Microsoft Teams anonymous/guest visitor access where it is not a business requirement
- Restrict loading of unsigned or unapproved third-party kernel drivers via Windows Defender Application Control policy
Longer-term hardening
- Enforce Windows Defender Application Control / HVCI-based vulnerable-driver blocklisting fleet-wide, not just on a per-incident basis
- Deploy network egress inspection capable of flagging anomalous QUIC sessions tunneled through legitimate collaboration-platform relay infrastructure
- Harden and restrict internet exposure of SQL/MSSQL servers, and patch aggressively, given the suspected initial access vector
- Deploy EDR with kernel self-protection / tamper resistance capable of surviving BYOVD-based process-termination attacks
CVEs associated with DragonForce Ransomware Abuses Microsoft Teams TURN Relays to
CVE-2023-52271, CVE-2025-61155, CVE-2025-1055
Weaknesses (CWE) in DragonForce Ransomware Abuses Microsoft Teams TURN Relays to
CWE-400, CWE-862
Timeline of DragonForce Ransomware Abuses Microsoft Teams TURN Relays to
- DragonForce ransomware-as-a-service operation (tracked by Symantec as Hackledorb) begins operating.
- DragonForce rebrands as a ransomware 'cartel,' offering white-label affiliate branding under its 'Ransom Bay' model.
- DragonForce announces a cartel partnership with LockBit, taking a cut to handle encryptors, infrastructure, and negotiation portals for partners.
- DragonForce publicly announces a coordination partnership with Qilin and LockBit to share resources and dictate ransomware market conditions.
- Attackers gain access to a U.S. services firm's network, executing PowerShell commands to retrieve TechSupV18Fix3.zip from 192.36.27.51, a ZIP archive disguised as a tech-support hotfix.
- Operators DLL side-load a malicious vboxrt.dll alongside the legitimate VirtualBox/DbgView64.exe binary to run reconnaissance and detection-evasion code.
- Attackers deploy multiple BYOVD drivers (wsftprm.sys/CVE-2023-52271, GameDriverX64.sys/CVE-2025-61155, K7RKScan.sys/CVE-2025-1055, HWAuidoOs2Ec.sys, and ABYSSWORKER) to terminate protected security processes.
- Backdoor.Turn is injected into the legitimate DbgView64.exe process, establishing C2 by obtaining an anonymous Teams visitor token and tunneling a QUIC session through a legitimate Microsoft TURN relay.
- Attackers conduct LDAP/Active Directory enumeration, harvest browser-stored credentials, and move laterally across the victim network using stolen credentials.
- After roughly one to two months of dwell time, the DragonForce ransomware payload is deployed, encrypting and exfiltrating victim data.
- Huntress researchers publicly document the HWAuidoOs2Ec.sys Huawei driver vulnerability used in the intrusion, after the attack had already occurred.
- Symantec's Broadcom Threat Hunter Team publishes 'Hidden in Teams,' disclosing Backdoor.Turn and the Microsoft Teams TURN relay C2 evasion technique; Help Net Security and The Hacker News report on the findings the same day.
Sources cited for DragonForce Ransomware Abuses Microsoft Teams TURN Relays to
- Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays to Stay Hidden
- Cybercriminals mask malicious communications through Microsoft Teams relays
- DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
- NVD - CVE-2023-52271
- NVD - CVE-2025-61155
- NVD - CVE-2025-1055
- Shedding light on the ABYSSWORKER driver
- Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates
- Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 1 of 2)
- Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 2 of 2)
- The DragonForce Cartel: Scattered Spider at the gate
More in ransomware
- Ransomware Attack Disrupts IT Systems and Services in Ellis County, Kansas
- KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home Trading System (HTS) Software
- Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed
- Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices
- Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian Targets via Exchange/SharePoint Exploitation
Detection coverage for TL-2026-2181
As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2181 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2181
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.