The DragonForce Hackers' Elusive Tactic: Hiding Backdoor.Turn C2 Traffic in Microsoft Teams
The world of cybersecurity is a cat-and-mouse game, and the latest move by DragonForce hackers showcases their ingenuity and adaptability. These threat actors have been observed employing a cunning strategy to conceal their command-and-control (C2) traffic within the Microsoft Teams relay infrastructure, leaving security analysts and defenders in a state of intrigue.
The Backdoor.Turn Trojan
At the heart of this operation is the Backdoor.Turn remote access trojan (RAT), a custom Go-based tool developed by the DragonForce group. This RAT is designed to obtain an anonymous Teams visitor token from Microsoft's Skype-backed identity services, leveraging a legitimate Microsoft TURN relay to establish a connection. Once the connection is set up, it initiates a QUIC session to the attacker's C2 server, all while appearing as legitimate Microsoft Teams traffic to network defenders.
Stealth and Persistence
What makes this attack particularly insidious is the duration of the attackers' presence on the victim network. They managed to remain undetected for an extended period, ranging from one to two months, showcasing their ability to maintain persistence and conduct covert operations. The initial compromise is achieved through a vulnerability in an SQL or MS-SQL server, possibly exploited by an initial access broker (IAB).
The PowerShell Drop and DLL Side-Loading
The attack sequence begins with a PowerShell command that drops a ZIP archive, masquerading as a tech support hotfix. This ZIP file contains a DLL side-loading attack, which then injects a rogue DLL into the system. The DLL is designed to silence security software using a Huawei driver, a technique known as bring your own vulnerable driver (BYOVD). This driver has been linked to a large-scale malvertising campaign targeting U.S.-based individuals seeking tax-related documents.
Drivers of Concern
The list of drivers used in this attack includes wsftprm.sys (CVE-2023-52271), GameDriverX64.sys (CVE-2025-61155), K7RKScan.sys (CVE-2025-1055), and ABYSSWORKER, a custom-built malicious driver previously associated with the Medusa ransomware.
Maintaining Access and Future Attacks
The execution of Backdoor.Turn within the DbgView64.exe process suggests a strategic move by the attackers. By injecting the RAT into a legitimate process, they ensure continued access to the compromised host, enabling future attacks or reselling the compromised system for profit. This approach highlights the attackers' focus on maintaining access and their ability to adapt their tactics.
The Ghost Calls Technique
Backdoor.Turn employs a stealthy C2 communication technique called Ghost Calls, which was documented by Praetorian in August 2024. This technique allows the backdoor to interact with Teams-associated infrastructure, establishing outbound connectivity without raising suspicion. The backdoor's capabilities include command execution, process creation, network scanning, LDAP and Active Directory search, credential-based lateral movement, and browser credential theft.
Implications and Future Trends
The DragonForce group's use of Backdoor.Turn and their multi-vector BYOVD evasion techniques demonstrate their evolution into a highly organized and persistent ransomware group. Their ability to adapt and employ sophisticated cyber tradecraft makes them a formidable threat. As the cybersecurity landscape continues to evolve, it is crucial for defenders to stay vigilant and proactive in their efforts to counter such sophisticated attacks.
In my opinion, this incident highlights the importance of continuous capability development and the need for security professionals to stay ahead of the curve. The DragonForce hackers' ability to leverage Microsoft Teams infrastructure for C2 traffic is a testament to their resourcefulness and adaptability, making it a fascinating yet concerning development in the realm of cybersecurity.
