# DragonForce backdoors abuse Microsoft Teams TURN servers and MQTT for resilient C2

> Lab52 reports DragonForce-linked backdoors that hide command-and-control in legitimate infrastructure: a Go-based Shell.dll injected in memory that abuses TURN (Microsoft Teams relays), and a javaw.exe/jli.dll sideloaded multi-stage loader for a second backdoor using MQTT. Both use DPAPI-bound payloads, scheduled-task persistence and encrypt their own memory while idle. Symantec's earlier Backdoor.Turn report ties the same TURN technique to a DragonForce ransomware intrusion that used BYOVD to kill security tools.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2836
- **ID:** TL-2026-2836
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** DragonForce (Malaysia)
- **Detections:** 9 · **IOCs:** 51 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-52271, CVE-2025-61155, CVE-2025-1055

## Description

On 2026-10-01 Lab52 published 'Backdoors in the dungeon: TURN & MQTT abused by DragonForce', documenting two custom backdoors attributed to the DragonForce ransomware-as-a-service (RaaS) operation (active since around 2023, since evolved into a cartel/infrastructure-provider model for affiliates). Lab52 relates the work to Symantec's earlier reporting on Backdoor.Turn (published 2026-06-16).

Backdoor 1 is a Go binary with metadata name Shell.dll that is injected directly into memory. It supports SSH-based communications authenticated with an embedded private key and abuses the TURN protocol for C2. The TURN channel uses messages of the form TRN1<UUID:16> with numeric command codes (22222222 C2 initiation; 33300000 task check, answered 'nocmd' when idle; 33299999 block download request; 3320 block retransmit; 33100000 task-receipt confirmation; 4440 beacon-to-C2 transfer initiation with blocks of up to 930 bytes; 4410 transfer status), with nonces generated via BCryptGenRandom. A TURN endpoint at 62.164.177.145:3478 is listed as an IOC.

Backdoor 2 is a multi-stage chain: the legitimate javaw.exe sideloads a malicious jli.dll (first-stage loader, three SHA256 variants published), which loads a DPAPI-encrypted, system-bound stage (rvsdiqw.txt) that runs the second backdoor. Staging payloads (25vtps.txt, dldwuibjn_chShllcodeTrn.txt/.bin) were fetched from http://188.190.4.111/. The second backdoor uses MQTT (described by Lab52 as a fallback channel) with a 16-character random session identifier, JSON commands validated by a 'cmdnum' field, and topic-based block retrieval with four-digit decimal indexes. Commands: cmdnum 1 inserts a URL (shk_url, tedByUID), cmdnum 2 runs a PowerShell line (ps_line, cmdid), cmdnum 3 executes a payload directly, cmdnum 4 inserts a remote host/port (rhost, rport). The MQTT endpoint 217.156.8.181:7586 is listed as an IOC.

Shared tradecraft: DLL sideloading via a legitimate executable, in-memory execution (CreateThread, VirtualProtect), XOR and Base64 payload obfuscation, DPAPI encryption that ties payloads to the host, scheduled-task persistence, and encryption of the memory region of the running code while sleeping (5-minute sleep before retry). Lab52 also lists several WordPress-hosted PHP endpoints (plus prolabgest.it) as IOCs; their precise role is not stated in the retrieved text.

Symantec (2026-06-16) analyzed Backdoor.Turn in a December 2025 DragonForce intrusion at a U.S. services company: a Go RAT that obtains an anonymous Teams visitor token from Microsoft's Skype-backed identity services, uses a legitimate Microsoft TURN relay, then runs a QUIC session to the real C2, so defenders see only outbound traffic to Microsoft. It was injected into DbgView64.exe and supports command execution, process creation, network scanning, TLS certificate capture, web page title collection, LDAP/Active Directory searching, credential-based lateral movement and browser credential theft. Symantec described it as the first known malware to abuse Teams TURN relays; the technique resembles Praetorian's 2025 'Ghost Calls' research on TURN credential hijacking. Initial access was likely an unknown SQL/MSSQL Server flaw (or an access broker). A PowerShell command pulled a ZIP (TechSupV18Fix3.zip from 192.36.27.51) containing legitimate VirtualBox/DbgView executables with malicious DLLs (vboxrt.dll) that fetched code from a list of C2 domains for recon, persistence and evasion. The actors modified LimitBlankPassword, added users/groups and altered firewall rules, used ADExplore and network scanners, and ran BYOVD to kill security tools with Huawei HWAuidoOs2Ec.sys ('Havoc Process Terminator'), Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), K7 Security K7RKScan.sys (CVE-2025-1055) and a custom driver, ABYSSWORKER, masquerading as a Palo Alto driver. DragonForce ransomware was then deployed, with Backdoor.Turn reportedly installed afterwards for continued access. Dwell time was roughly 1-2 months. Press coverage links DragonForce to Scattered Spider; The Hacker News names the actor behind DragonForce as 'Hackledorb'. No CVE is assigned to the backdoors themselves; severity is analyst-assigned.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1136 Create Account
- T1574.001 DLL
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1480.001 Environmental Keying
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1112 Modify Registry
- T1555.003 Credentials from Web Browsers
- T1087.002 Domain Account
- T1046 Network Service Discovery
- T1071 Application Layer Protocol
- T1090.002 External Proxy
- T1572 Protocol Tunneling

## Sources

- [Backdoors in the dungeon: TURN & MQTT abused by DragonForce (Lab52)](https://lab52.io/blog/backdoors-in-the-dungeon-turn-mqtt-abused-by-dragonforce/)
- [Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays to Stay Hidden (Symantec)](https://www.security.com/blog-post/dragonforce-msteams-backdoor)
- [Ransomware gang abuses Microsoft Teams relays to hide malicious traffic (BleepingComputer)](https://bleepingcomputer.com/news/security/ransomware-gang-abuses-microsoft-teams-relays-to-hide-malicious-traffic)
- [Cybercriminals mask malicious communications through Microsoft Teams relays (Help Net Security)](https://www.helpnetsecurity.com/2026/06/16/dragonforce-microsoft-teams-malware-backdoor-turn/)
- [DragonForce Hackers Abuse Microsoft Teams Relays (The Hacker News)](https://thehackernews.com/2026/06/dragonforce-hackers-abuse-microsoft.html)
- [DragonForce ransomware backdoor weaponises legit Microsoft Teams servers (Techfinitive)](https://www.techfinitive.com/dragonforce-ransomware-backdoor-weaponises-legit-microsoft-teams-servers/)
- [DragonForce Hackers Exploit Microsoft Teams TURN Relays to Conceal Backdoor.Turn C2 (Rescana)](https://www.rescana.com/post/dragonforce-hackers-exploit-microsoft-teams-turn-relays-to-conceal-backdoor-turn-c2-in-targeted-ransomware-attacks)
- [Ransomware Operators Use Microsoft Teams Servers to Hide Their Traffic (Hackmag)](https://hackmag.com/news/dragonforce-teams)
- [How DragonForce Weaponized Microsoft Teams to Outlast Its Own Ransomware (Security Buzz)](https://securitybuzz.com/cybersecurity-news/dragonforce-weaponized-microsoft-teams/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2836