DragonForce Ransomware Abuses Microsoft Teams TURN Relays to Hide Backdoor.Turn C2 Traffic

DragonForce Ransomware Abuses Microsoft Teams TURN Relays to (TL-2026-2181) is a critical-severity ransomware operation, first published 2026-06-16. It is attributed to DragonForce (Malaysia) with high confidence, affects Topaz Evolution Antifraud (wsftprm.sys kernel driver), references 3 CVEs (CVE-2023-52271, CVE-2025-61155, CVE-2025-1055), maps to 15 MITRE ATT&CK techniques (T1021, T1027, T1036.005), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-2181

Threat ID
TL-2026-2181
Severity
CRITICAL
Status
ACTIVE
Category
RANSOMWARE
First published
2026-06-16
Last reviewed
2026-06-16
Attribution
DragonForce
Attribution confidence
HIGH
Nation-state nexus
Malaysia
Motivation
FINANCIAL
Target sectors
professional services
Target regions
North America
Detection rules
9
Indicators of compromise
30

Malware and tooling in DragonForce Ransomware Abuses Microsoft Teams TURN Relays to

Malware and tooling: Backdoor.Turn, DragonForce, ransombay, ABYSSWORKER

Symantec's Broadcom Threat Hunter Team identified Backdoor.Turn, a Go-based backdoor deployed by the DragonForce ransomware cartel (tracked as Hackledorb), that abuses legitimate Microsoft Teams TURN relay infrastructure to conceal C2 traffic. Deployed during a 1-2 month intrusion at a U.S. services firm, the backdoor obtains an anonymous Teams visitor token, routes through a genuine Microsoft TURN relay, and then opens a direct QUIC session to the real C2 server before the DragonForce ransomware payload is dropped.

How DragonForce Ransomware Abuses Microsoft Teams TURN Relays to works

Symantec/Broadcom's Threat Hunter Team documented an intrusion at a U.S. services firm in which the DragonForce ransomware cartel (the group Symantec tracks internally as Hackledorb) maintained access for one to two months before deploying its ransomware payload. Initial access is suspected to involve exploitation of an internet-facing SQL or Microsoft SQL Server, or purchase of existing access from an initial access broker; the exact entry point was not conclusively determined. In December 2025 the operators executed PowerShell commands to retrieve a ZIP archive disguised as a tech-support hotfix ('TechSupV18Fix3.zip') from 192.36.27.51, then used DLL side-loading of a legitimate VirtualBox/DbgView64.exe binary paired with a malicious 'vboxrt.dll' to run reconnaissance and evasion code.

The attackers escalated defense evasion using a bring-your-own-vulnerable-driver (BYOVD) chain: three previously known vulnerable, signed kernel drivers (Topaz Antifraud wsftprm.sys / CVE-2023-52271, Tower of Fantasy GameDriverX64.sys / CVE-2025-61155, and K7 Security K7RKScan.sys / CVE-2025-1055) were abused to terminate protected security processes via crafted IOCTL requests, alongside a novel abuse of a Huawei HWAuidoOs2Ec.sys driver (documented publicly by Huntress only in March 2026, after this intrusion) and ABYSSWORKER -- a custom malicious driver, signed with likely-stolen certificates, that masquerades as a CrowdStrike Falcon driver and was first documented powering Medusa ransomware EDR-killing attacks.

The centerpiece of the intrusion is Backdoor.Turn, a Go-based remote access backdoor injected into the legitimate DbgView64.exe process. Backdoor.Turn requests an anonymous Microsoft Teams visitor token from Microsoft's Skype-backed identity services, uses that token to obtain credentials for a legitimate Microsoft TURN (Traversal Using Relays around NAT) relay server, and then tunnels a direct QUIC session to the attacker's real C2 server through that relay. Because the only traffic a network defender observes is an outbound connection to genuine Microsoft Teams/Skype infrastructure, the technique conceals the true C2 channel entirely within trusted collaboration-platform traffic. Symantec states this is the first known in-the-wild abuse of TURN relay infrastructure for C2 in this manner; the approach mirrors 'Ghost Calls,' a WebRTC/TURN-tunneling C2 technique against Zoom, Teams, and Google Meet publicly presented by Praetorian researcher Adam Crosser (open-sourced as the 'TURNt' tool) at Black Hat USA. Backdoor.Turn supports command execution, process creation, network/TLS-certificate/web-title scanning, LDAP and Active Directory searching, credential-based lateral movement, and browser credential theft.

For persistence and further defense evasion, the operators modified the LimitBlankPassword registry setting, created local backdoor accounts, and altered host firewall rules to permit their C2 communications. After roughly one to two months of dwell time, DragonForce deployed its ransomware payload, encrypting and exfiltrating victim data. DragonForce, active since June 2023, has since March 2025 operated as a formalized ransomware 'cartel' offering white-label branding to affiliates under its 'Ransom Bay' program, and by August-September 2025 had announced coordination partnerships with LockBit and Qilin -- evidence Symantec cites of the group's growing organizational maturity and technical sophistication.

MITRE ATT&CK techniques used in TL-2026-2181

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1574.001 DLL

Discovery

T1046 Network Service Discovery; T1087.002 Domain Account

Execution

T1059.001 PowerShell

Command and Control

T1090.002 External Proxy; T1573 Encrypted Channel

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall

Persistence

T1136.001 Local Account

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1555.003 Credentials from Web Browsers

Affected products and versions in DragonForce Ransomware Abuses Microsoft Teams TURN Relays to

  • Topaz Evolution — Antifraud (wsftprm.sys kernel driver)
    Vulnerable versions: 2.0.0.0 and prior
    Fixed in: not publicly specified
  • Hotta Studio — Tower of Fantasy (GameDriverX64.sys kernel driver)
    Vulnerable versions: 7.23.4.7 and prior
    Fixed in: not publicly specified
  • K7 Security — K7 Security Anti-Malware (K7RKScan.sys kernel driver)
    Vulnerable versions: prior to 23.0.0.10
    Fixed in: 23.0.0.10
  • Huawei — HWAuidoOs2Ec.sys kernel driver
    Vulnerable versions: novel BYOVD abuse documented by Huntress March 2026, no public patch identified in sources
  • Microsoft — Microsoft Teams / Skype TURN relay infrastructure (abused as a covert channel, not itself vulnerable)

Remediation for DragonForce Ransomware Abuses Microsoft Teams TURN Relays to

Patches

  • Update Topaz Antifraud beyond the vulnerable wsftprm.sys 2.0.0.0 (CVE-2023-52271)
  • Update Tower of Fantasy's GameDriverX64.sys beyond v7.23.4.7 (CVE-2025-61155)
  • Update K7 Security Anti-Malware to K7RKScan.sys 23.0.0.10 or later (CVE-2025-1055)

Immediate actions

  • Monitor and alert on Microsoft Teams/Skype TURN relay traffic originating from non-interactive, headless, or unexpected processes rather than the Teams client itself
  • Hunt for DbgView64.exe or VirtualBox binaries running from non-standard install paths alongside unexpected companion DLLs such as vboxrt.dll
  • Block/deny-list the known vulnerable driver files by hash and name (wsftprm.sys, GameDriverX64.sys, K7RKScan.sys, HWAuidoOs2Ec.sys, ABYSSWORKER/smuol.sys) via Microsoft's vulnerable driver blocklist (WDAC/HVCI)
  • Block outbound traffic to the identified C2 IP (62.164.177.25) and C2/distribution domains, and alert on retrieval of archives named similarly to TechSupV18Fix3.zip

Workarounds

  • Restrict or closely monitor Microsoft Teams anonymous/guest visitor access where it is not a business requirement
  • Restrict loading of unsigned or unapproved third-party kernel drivers via Windows Defender Application Control policy

Longer-term hardening

  • Enforce Windows Defender Application Control / HVCI-based vulnerable-driver blocklisting fleet-wide, not just on a per-incident basis
  • Deploy network egress inspection capable of flagging anomalous QUIC sessions tunneled through legitimate collaboration-platform relay infrastructure
  • Harden and restrict internet exposure of SQL/MSSQL servers, and patch aggressively, given the suspected initial access vector
  • Deploy EDR with kernel self-protection / tamper resistance capable of surviving BYOVD-based process-termination attacks

CVEs associated with DragonForce Ransomware Abuses Microsoft Teams TURN Relays to

CVE-2023-52271, CVE-2025-61155, CVE-2025-1055

Weaknesses (CWE) in DragonForce Ransomware Abuses Microsoft Teams TURN Relays to

CWE-400, CWE-862

Timeline of DragonForce Ransomware Abuses Microsoft Teams TURN Relays to

  • DragonForce ransomware-as-a-service operation (tracked by Symantec as Hackledorb) begins operating.
  • DragonForce rebrands as a ransomware 'cartel,' offering white-label affiliate branding under its 'Ransom Bay' model.
  • DragonForce announces a cartel partnership with LockBit, taking a cut to handle encryptors, infrastructure, and negotiation portals for partners.
  • DragonForce publicly announces a coordination partnership with Qilin and LockBit to share resources and dictate ransomware market conditions.
  • Attackers gain access to a U.S. services firm's network, executing PowerShell commands to retrieve TechSupV18Fix3.zip from 192.36.27.51, a ZIP archive disguised as a tech-support hotfix.
  • Operators DLL side-load a malicious vboxrt.dll alongside the legitimate VirtualBox/DbgView64.exe binary to run reconnaissance and detection-evasion code.
  • Attackers deploy multiple BYOVD drivers (wsftprm.sys/CVE-2023-52271, GameDriverX64.sys/CVE-2025-61155, K7RKScan.sys/CVE-2025-1055, HWAuidoOs2Ec.sys, and ABYSSWORKER) to terminate protected security processes.
  • Backdoor.Turn is injected into the legitimate DbgView64.exe process, establishing C2 by obtaining an anonymous Teams visitor token and tunneling a QUIC session through a legitimate Microsoft TURN relay.
  • Attackers conduct LDAP/Active Directory enumeration, harvest browser-stored credentials, and move laterally across the victim network using stolen credentials.
  • After roughly one to two months of dwell time, the DragonForce ransomware payload is deployed, encrypting and exfiltrating victim data.
  • Huntress researchers publicly document the HWAuidoOs2Ec.sys Huawei driver vulnerability used in the intrusion, after the attack had already occurred.
  • Symantec's Broadcom Threat Hunter Team publishes 'Hidden in Teams,' disclosing Backdoor.Turn and the Microsoft Teams TURN relay C2 evasion technique; Help Net Security and The Hacker News report on the findings the same day.

Sources cited for DragonForce Ransomware Abuses Microsoft Teams TURN Relays to

More in ransomware

Detection coverage for TL-2026-2181

As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2181 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2181

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats