DragonForce Used Microsoft Teams TURN Relays to Hide Backdoor C2 Traffic
Summary
Symantec reports that DragonForce used the Go-based Backdoor.Turn to route C2 through Microsoft Teams TURN relays. The campaign also used vulnerable drivers to evade defenses before exfiltrating data and encrypting a victim’s systems.
Key points
- Symantec says the campaign targeted a major U.S. services company and was observed in December 2025; it may have begun by exploiting an unknown SQL or MSSQL server flaw.
- Backdoor.Turn obtains an anonymous Teams visitor token and uses a legitimate Microsoft TURN relay to communicate with attacker-controlled C2, making traffic appear associated with Microsoft.
- The attackers used BYOVD with multiple drivers to gain kernel-level access and terminate security tools; identified examples include Huawei’s HWAuidoOs2Ec.sys and the custom ABYSSWORKER driver.
- The attack sequence included persistence measures, rogue users, changes to firewall rules, and abuse of the Windows LimitBlankPassword policy.
- Backdoor.Turn is a Go-based RAT with capabilities including command execution, network scanning, LDAP/Active Directory searches, TLS certificate capture, and browser credential theft.
- Symantec describes this as the first known in-the-wild malware to abuse Microsoft Teams TURN relays for C2. The attackers reportedly exfiltrated data, deployed DragonForce ransomware, and encrypted the victim’s systems.
Article Details
- Attack Vectors
- The attack likely began with exploitation of an unknown flaw in an SQL or MSSQL server.
- The attackers downloaded a ZIP archive containing a legitimate VirtualBox/DbgView executable and a malicious DLL for sideloading.
- The attackers used multiple vulnerable drivers in BYOVD activity to gain kernel-level privileges and terminate security tools.
- Backdoor.Turn obtained an anonymous Microsoft Teams visitor token and used a Teams TURN relay to communicate with the attacker’s C2 server.
- The attackers created rogue users, changed the Windows LimitBlankPassword security policy, and modified firewall rules.
- After reconnaissance and data exfiltration, the attackers deployed DragonForce ransomware and encrypted the victim’s systems.
- Defensive Notes
- Symantec published a list of indicators of compromise to help defenders detect and block the attacks; no individual indicators are included in the supplied article.
- The article identifies Microsoft Teams TURN relay abuse and BYOVD activity that terminates security tools as relevant detection concerns.
MITRE ATT&CK
T1046 · Network Service DiscoveryBackdoor.Turn's reported capabilities include network scanning.T1055 · Process InjectionBackdoor.Turn was injected into DbgView64.exe.T1068 · Exploitation for Privilege EscalationThe attackers used vulnerable drivers in BYOVD activity to obtain kernel-level privileges.T1090 · ProxyBackdoor.Turn used Microsoft Teams TURN relay infrastructure to route and conceal its C2 communications.T1105 · Ingress Tool TransferThe attackers downloaded a ZIP archive containing a legitimate executable and a malicious DLL.T1136 · Create AccountThe attackers created rogue user accounts; the article does not specify the account type.T1190 · Exploit Public-Facing ApplicationThe attack likely began with exploitation of an unknown flaw in an SQL or MSSQL server.T1486 · Data Encrypted for ImpactThe attackers deployed DragonForce ransomware to encrypt the victim’s systems.T1555.003 · Credentials from Web BrowsersBackdoor.Turn's reported capabilities include browser credential theft.T1562.001 · Disable or Modify ToolsThe attackers used the vulnerable drivers to terminate security tools on the host.T1562.004 · Disable or Modify System FirewallThe attackers modified firewall rules.T1574.002 · DLL Side-LoadingThe attackers used a malicious DLL for sideloading alongside a legitimate VirtualBox/DbgView executable.
CVE
CVE-2023-52271Topazevolution · Antifraudtechniques with multiple drivers such as Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys (CVE-2025-1055),CVE-2025-1055K7 Security · K7 Security Anti-Malware(CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys (CVE-2025-1055), to obtain kernel-level privileges and terminate security tools on the host.CVE-2025-61155Vendor / Product unavailableHWAuidoOs2Ec.sys, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys (CVE-2025-1055), to obtain kernel-level privileges and terminate
Threat Actors
DragonForceThe article describes DragonForce as a ransomware operation active since at least 2023 and reports that it deployed ransomware in the attack.Scattered SpiderThe article says DragonForce has been linked to Scattered Spider; it does not establish that Scattered Spider conducted this specific attack.
Malware
AbyssWorkerThe hacker also used ABYSSWORKER, a custom malicious driver masquerading as a legitimate Palo Alto driver.Backdoor.TurnDragonForce used a custom Go-based backdoor called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams TURN relay infrastructure, making its communications look like trusted Microsoft traffic.DragonForceDragonForce used a custom Go-based backdoor called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams TURN relay infrastructure, making its communications look like trusted Microsoft traffic.
Vendors
HuaweiThe researchers also highlight the exploitation of Huawei’s HWAuidoOs2Ec.sys driver (“Havoc Process Terminator”), which is used for evasion in Bring Your Own Vulnerable Driver (BYOVD) tactics.K7 SecurityTopaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys (CVE-2025-1055), to obtain kernel-level privileges and terminate security tools on theMicrosoftDragonForce used a custom Go-based backdoor called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams TURN relay infrastructure, making its communications look like trusted Microsoft traffic.Palo Alto NetworksThe hacker also used ABYSSWORKER, a custom malicious driver masquerading as a legitimate Palo Alto driver.Topaz AntifraudNext, they used BYOVD techniques with multiple drivers such as Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sysTower of Fantasymultiple drivers such as Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys (CVE-2025-1055), to obtain
Products
DbgViewOnce the attacker established a foothold, they downloaded a ZIP archive containing a legitimate VirtualBox/DbgView executable and a malicious DLL file used for sideloading.Gamedriverx64.syssuch as Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys (CVE-2025-1055), to obtain kernel-level privilegesHWAuidoOs2Ec.sysThe researchers also highlight the exploitation of Huawei’s HWAuidoOs2Ec.sys driver (“Havoc Process Terminator”), which is used for evasion in Bring Your Own Vulnerable Driver (BYOVD) tactics.K7RKScan.syswsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys (CVE-2025-1055), to obtain kernel-level privileges and terminate security tools on the host.Microsoft TeamsDragonForce used a custom Go-based backdoor called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams TURN relay infrastructure, making its communications look like trusted Microsoft traffic.Microsoft WindowsAt this stage, the attacker strengthened their persistence, created rogue users, abused the LimitBlankPassword security policy in Windows for easy access, and modified firewall rules.VirtualBoxOnce the attacker established a foothold, they downloaded a ZIP archive containing a legitimate VirtualBox/DbgView executable and a malicious DLL file used for sideloading.wsftprm.systhey used BYOVD techniques with multiple drivers such as Huawei’s HWAuidoOs2Ec.sys, Topaz Antifraud wsftprm.sys (CVE-2023-52271), Tower of Fantasy GameDriverx64.sys (CVE-2025-61155), and K7 Security K7RKScan.sys