DragonForce Crew Tunnels RAT Traffic Through Microsoft Teams Relays

Key points

• DragonForce operators have deployed a custom Go-based RAT called Backdoor.Turn against a major U.S. Services firm.
• The implant hides command-and-control traffic inside Microsoft Teams relay infrastructure, blending with traffic defenders routinely trust.
• Symantec and Carbon Black, both under Broadcom, identified the backdoor and have released indicators through Symantec's protection bulletin.
• No CVE is attached: this is tradecraft, not an exploited vulnerability.
• Endpoint telemetry, not network filtering, is the more reliable detection surface.

What is Backdoor.Turn?

Backdoor.Turn is a Go-written remote access trojan that routes its command-and-control traffic through Microsoft Teams relay infrastructure. Symantec and Carbon Black flagged it after it appeared during an incident at a large U.S. Services company, whose name was not disclosed. The implant carries a standard post-intrusion feature set: shell execution and file transfer, with persistent beaconing over the Teams relay path.

Go is the language of choice for the familiar reasons: a single static binary that compiles cleanly across platforms, with reflection-heavy code that slows signature development. It's the same architectural choice Gentlemen ransomware made, as we noted on 29 May 2026, and it keeps showing up in DragonForce-linked tooling for good reason.

Why does the Teams relay path matter?

Teams chat and call traffic transits Microsoft-hosted relays that most enterprises neither block nor deeply inspect. Routing C2 over that path means the attacker's traffic looks like TLS to Microsoft IP space with expected hostnames and a predictable cadence. Egress filtering doesn't help when the destination is the same relay infrastructure your finance team uses for calls.

C2 tunneling through Teams is a step beyond the phishing and token-theft campaigns Midnight Blizzard has run through the same platform. It raises the bar on what "normal" Teams traffic should look like, and defenders who have not revisited that assumption are the target audience for this technique.

What should defenders actually do?

Endpoint telemetry is the detection surface that matters here, not the network perimeter. Look for unknown Go binaries spawning outbound connections to Teams relay addresses, especially on hosts where the Teams client is not installed. Unsigned binaries persisting through scheduled tasks or run keys deserve immediate scrutiny.

Symantec has released hashes and network indicators through its protection bulletin. Pull those and run retroactive hunts across at least 90 days of EDR and proxy data. Anomalous token-grant activity in Entra ID logs has been a recurring precursor in DragonForce-linked intrusions and is worth including in that hunt.

Microsoft had not, at time of writing, published guidance specific to Backdoor.Turn.

How does this fit DragonForce's wider operation?

DragonForce runs an affiliate-style model and spent 2024 and 2025 absorbing tooling from other crews, including the leaked LockBit builder and components from the now-defunct RansomHub. Adding a bespoke RAT is consistent with a group trying to professionalize its intrusion stage rather than depend on commodity access brokers. The operational read is that DragonForce is investing in the parts of an attack that precede encryption, which is where defenders are least likely to be looking.