DragonForce Crew Tunnels RAT Traffic Through Microsoft Teams Relays

Operators tied to the DragonForce ransomware brand are running a custom Go-written remote access trojan that smuggles command-and-control traffic through Microsoft Teams relay infrastructure, hiding malicious sessions inside traffic that defenders are conditioned to treat as benign.

The malware is being tracked as Backdoor.Turn. Researchers at Symantec and Carbon Black (both now under Broadcom) flagged the implant after it surfaced during an incident at a large U.S. services company. The victim was not named.

The trick is the channel, not the payload. Teams chat and call traffic transits Microsoft-hosted relays that enterprises rarely block or deeply inspect. By routing C2 over that path, the attackers blend into telemetry that already looks normal on the wire — TLS to Microsoft IP space, expected SNIs, predictable cadence. Egress filtering doesn't help when the destination is the same CDN your finance team uses for stand-ups.

Go is the language of choice here for the usual reasons: single static binary, trivial cross-compilation, and reflection-heavy code that frustrates quick signature work. Symantec's writeup describes Backdoor.Turn as a relatively compact RAT with the standard feature set you'd expect from a post-intrusion tool — shell execution, file transfer, and persistent beaconing through the Teams relay path.

DragonForce itself has been busy. The group runs an affiliate-style operation and has spent 2024 and 2025 absorbing branding and tooling from other crews, including the leaked LockBit builder and components associated with the now-defunct RansomHub. Adding a bespoke loader/RAT to that mix is consistent with a group trying to professionalize its intrusion stage rather than rely solely on commodity access brokers.

For defenders, the operational read is straightforward.

Treat Microsoft 365 egress as an attack surface, not a trust boundary. Teams-relay abuse is not new (Storm-1811 and Midnight Blizzard have both staged phishing and token theft through the platform), but C2 tunneling raises the bar on what "normal" Teams traffic should look like. Endpoint telemetry — process trees showing unknown Go binaries spawning network connections to *.teams.microsoft.com or to Teams relay IPs — is the more reliable detection surface than the network itself.

A few things to check in your environment:

• Outbound connections to Teams relay infrastructure from hosts that don't have the Teams client installed.
• Unsigned or unusual Go binaries persisting via scheduled tasks, services, or run keys.
• Anomalous device-code or token-grant activity in Entra ID logs, which has been a recurring precursor in DragonForce-linked intrusions.

No CVE is attached to this activity (it's tradecraft, not a vulnerability), and Microsoft has not, at time of writing, published guidance specific to Backdoor.Turn. Symantec has released indicators through its protection bulletin; defenders should pull hashes and network IOCs from there and run retroactive hunts across at least 90 days of EDR and proxy data.