DragonForce Uses Teams Relays and Backdoor.Turn in Attack on U.S. Services Firm
Summary
Symantec describes a DragonForce intrusion using Backdoor.Turn to route command-and-control setup through Microsoft Teams relays, plus DLL sideloading and vulnerable drivers to evade defenses. The initial access method is unknown.
Key points
- Symantec reports DragonForce attackers remained on a major U.S. services firm’s network for one to two months before deploying ransomware.
- Backdoor.Turn obtains an anonymous Teams visitor token, uses Microsoft TURN infrastructure for connection setup, then establishes a QUIC session with the attackers’ C2 server.
- The Go-based backdoor supports command execution, network and Active Directory reconnaissance, credential-based lateral movement, and browser credential theft.
- Attackers used DLL sideloading with a malicious VirtualBox-related DLL and modified system settings to maintain access and facilitate remote connections.
- BYOVD techniques were used to terminate security processes, including exploitation of several vulnerable drivers and a custom technique involving Huawei’s HWAuidoOs2Ec.sys.
- The researchers say the initial access may have involved exploiting an SQL or MSSQL server, but the vulnerability is unknown; purchased access is also a possibility.
Article Details
- Attack Vectors
- The attackers appear to have gained access by exploiting an unknown vulnerability in an SQL or MSSQL server; the article also says access may have been purchased from an access broker.
- A malicious vboxrt.dll was sideloaded by a legitimate VirtualBox/DbgView executable to execute code with the trusted process's privileges.
- The attackers used vulnerable or malicious drivers to gain kernel-level access and terminate security processes, including drivers associated with Huawei, Topaz Antifraud, Tower of Fantasy, and K7 Security.
- Backdoor.Turn used Microsoft Teams visitor-token and TURN relay infrastructure to conceal connection setup before establishing a QUIC session to the attackers' C2 server.
- The attackers modified system settings, added users or groups, and changed firewall rules to preserve access and facilitate remote access and C2 communication.
- The attackers used reconnaissance, credential-based lateral movement, and browser credential theft before deploying DragonForce ransomware to exfiltrate data and encrypt victim machines.
- Defensive Notes
- The article reports that defenders could see outbound connections to legitimate Microsoft Teams servers while Backdoor.Turn used the relay infrastructure to reach its malicious C2 server.
- The article cites the Symantec Protection Bulletin for the latest protection updates.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | comunidadesparentais[.]com[.]br | C2 domain used to download additional tools. |
| DOMAIN | glanz-gmbh[.]de | C2 domain used to download additional tools. |
| DOMAIN | mysimerp[.]net | C2 domain used to download additional tools. |
| DOMAIN | professionalhomebasedbusiness[.]com | C2 domain used to download additional tools. |
| DOMAIN | projetosmecanicos[.]com[.]br | C2 domain used to download additional tools. |
| DOMAIN | safefire[.]jo | C2 domain used to download additional tools. |
| DOMAIN | socialbizsolutions[.]com | C2 domain used to download additional tools. |
| DOMAIN | turnkeyaiagents[.]com | C2 domain used to download additional tools. |
| IPV4 | 62[.]164[.]177[.]25 | Backdoor.Turn C2 server. |
| SHA256 | 048e18416177de2ead251abdf4d89837f6807c6aba4d5b1debe49adfdecbf05c | Hash identified in the article as Backdoor.Turn. |
| SHA256 | 087f002df0a02c8c74f3ba5cd99cf29fb9efff38bf57b3d808e34a5dd4200dd2 | Hash identified in the article as the Tower of Fantasy vulnerable driver used in the intrusion. |
| SHA256 | 142bac0e2148e0d47891b6cd7311195c4acbe33b700fad54a201c52a2bc46219 | Hash identified in the article as ADExplore used in the intrusion. |
| SHA256 | 252a8bb2eb9c96c5e6cc7cab822e2ed0d508032f9350351221781684e86c03ab | Hash identified in the article as the Topaz Antifraud vulnerable driver used in the intrusion. |
| SHA256 | 6bbf10bcbef7ac5102b54c81137859891a3802dbacd888be90f990d50e18b0b4 | Hash identified in the article as an AV killer used in the intrusion. |
| SHA256 | 821da79d727351dd67ce5df7950e9a3de6647a3cf474bb3a093f67507fed92a6 | Hash identified in the article as Backdoor.Turn. |
| SHA256 | 8284c8676cc22c4b2e66826ac16986da7ddecba1f2776b16771be17bfdc45dc2 | Hash identified in the article as the malicious ABYSSWORKER driver. |
| SHA256 | 82b37a92589dfd4d67ca87eb9e52ac8e682e8e60d2211f59074cd5ccc693013b | Hash identified in the article as a downloader. |
| SHA256 | 8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531 | Hash identified in the article as Havoc Process Terminator. |
| SHA256 | 9335f61f8ad276d94455c5b6876fea48152c3cea759f2598c8108ee461fa5759 | Hash identified in the article as a malicious ZIP archive downloaded during the intrusion. |
| SHA256 | b16e217cdca19e00c1b68bdfb28ead53b20adeabd6edcd91542f9fbf48942877 | Hash identified in the article as the K7 vulnerable driver used in the intrusion. |
| SHA256 | b6628d201c2a68d2a3de2a87de7a5acfe21b101a97928e1c8d5c82102d967383 | Hash identified in the article as the GameDriverx64 vulnerable driver used in the intrusion. |
| SHA256 | ce66b8221446c9b6d83f0ce6382f430e519601641e5daaaf1ca7a8a8806cb0b0 | Hash identified in the article as shellcode containing Backdoor.Turn. |
| SHA256 | d0da2832ae1e13a98f7ce7e33a66c1b0d9797b81f69ece134e4462ea55ac923e | Hash identified in the article as Netscan used in the intrusion. |
| SHA256 | e45b18c93d187aac5c4486f57483bc87580e15def82a312bfb377ff16eb96b22 | Hash identified in the article as DragonForce ransomware. |
| SHA256 | f174c19902523dcf005fa044b6598403a5e5c0a5982398d1bc0dcc5ec1cd351b | Hash identified in the article as a sideloaded DLL mimicking VirtualBox. |
| URL | hxxp[:]//192[.]36[.]27[.]51/TechSupV18Fix3.zip | URL identified as the download location for a malicious ZIP archive. |
MITRE ATT&CK
T1046 · Network Service DiscoveryBackdoor.Turn performed network scanning for reconnaissance.T1055 · Process InjectionBackdoor.Turn was injected into the legitimate DbgView64.exe process.T1068 · Exploitation for Privilege EscalationThe attackers exploited vulnerable drivers to gain kernel-level access.T1087.002 · Domain AccountBackdoor.Turn searched LDAP/AD for domain mapping.T1090.002 · External ProxyBackdoor.Turn used a legitimate Microsoft TURN relay to conceal connection setup to its C2 server.T1105 · Ingress Tool TransferA malicious ZIP archive was downloaded, and the sideloaded DLL downloaded code from a list of servers.T1136 · Create AccountThe attackers added users or groups to create another means of accessing compromised machines.T1486 · Data Encrypted for ImpactDragonForce ransomware encrypted victim machines.T1555.003 · Credentials from Web BrowsersBackdoor.Turn stole browser credentials from compromised endpoints.T1562.001 · Disable or Modify ToolsThe attackers used drivers to terminate security processes and evade detection.T1562.004 · Disable or Modify System FirewallThe attackers modified firewall rules to facilitate remote access and C2 communication.T1574.002 · DLL Side-LoadingA malicious vboxrt.dll was sideloaded by a legitimate VirtualBox/DbgView executable.
CVE
CVE-2023-52271Topazevolution · AntifraudCVE-2023-52271: Exploitation of Topaz Antifraud’s wsftprm.sys.CVE-2025-1055K7 Security · K7 Security Anti-MalwareCVE-2025-1055: K7 Security Anti-Malware’s K7RKScan.sysCVE-2025-61155Vendor / Product unavailableCVE-2025-61155: Exploitation of Tower of Fantasy’s Gamedriverx64.sys.
People
Threat Actors
Malware
AbyssWorkerThe attackers also use the Abyss Worker driver for defense evasion, which doesn’t really fit the definition of BYOVD, as it is a custom-built malicious driver that masquerades as a legitimate Palo Alto driver.Backdoor.TurnBackdoor.Turn hid command-and-control traffic through Microsoft Teams relay infrastructure.DragonForceDragonForce ransomware was deployed against a major U.S.
Vendors
Huaweia novel attack exploiting the Havoc Process Terminator, in which they use a custom technique to leverage Huawei’s HWAuidoOs2Ec.sys.K7 SecurityCVE-2025-1055: K7 Security Anti-Malware’s K7RKScan.sysMicrosoftBackdoor.Turn hid command-and-control traffic through Microsoft Teams relay infrastructure.Topaz AntifraudCVE-2023-52271: Exploitation of Topaz Antifraud’s wsftprm.sys.
Products
DbgView64.exeThe most noteworthy tool used in this operation is Backdoor.Turn, a new Go-based remote access backdoor, injected into the legitimate DbgView64.exe process for stealth.Gamedriverx64.sysCVE-2025-61155: Exploitation of Tower of Fantasy’s Gamedriverx64.sys.HWAuidoOs2Ec.sysexploiting the Havoc Process Terminator, in which they use a custom technique to leverage Huawei’s HWAuidoOs2Ec.sys.K7RKScan.sysCVE-2025-1055: K7 Security Anti-Malware’s K7RKScan.sysMicrosoft TeamsBackdoor.Turn hid command-and-control traffic through Microsoft Teams relay infrastructure.SkypeBackdoor.Turn obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to set up the connection, and then runs a QUIC session to the attacker’sVirtualBoxThe attackers used DLL sideloading with a malicious VirtualBox-related DLL for stealth.wsftprm.sysCVE-2023-52271: Exploitation of Topaz Antifraud’s wsftprm.sys.