💢 Decoded – Microsoft Teams as a C2 channel: what DragonForce taught us

DragonForce hid ransomware C2 inside Microsoft Teams relays for two weeks. No patch closes this. No alert fired.

Symantec and Carbon Black published their findings on 16 June. DragonForce ransomware. A major US services firm. Two weeks of undetected dwell time, and the attack traffic, the Microsoft Teams C2 channel, looked, to every monitoring tool on the network, like legitimate Microsoft infrastructure. Because it was.

That is where we start.

The assumption the whole stack is built on

The architecture of network defense, and I mean this going back to the early days of stateful packet inspection, to the Cisco PIX boxes that ran in every medium enterprise around 2001, is built on a model of trusted infrastructure and untrusted external traffic. The firewall’s job is to distinguish between the two. The SIEM’s job is to alert on anomalies. The EDR’s job is to catch behavior that deviates from the baseline.

Implicit in all of this: traffic to known, legitimate, large-vendor infrastructure is, if not safe, at least not the immediate priority.
You tune down the noise from Microsoft.
You tune down the noise from Google.
You have to, otherwise the alert queue becomes unusable.

That implicit assumption is twenty years old. It was reasonable when attackers were building their own C2 infrastructure, buying VPS instances in bulletproof hosting, registering lookalike domains. It made sense to treat outbound to 195.54.231.x with suspicion and outbound to teams.microsoft.com with something close to trust.

So, DragonForce read that assumption and built a tool around it.

What Backdoor.Turn actually does

The custom Go-based RAT documented by Symantec (Backdoor.Turn) requests an anonymous visitor token from Microsoft’s own Teams/Skype identity services. Legitimate token, issued by Microsoft, using a legitimate API call. Then it uses that token to interact with Microsoft TURN relay servers, routing all command-and-control traffic through infrastructure that your network monitoring has been trained to ignore.

The technique has a lineage. Praetorian documented the underlying TURN-based approach, they called it Ghost Calls, back in August 2024. The idea is not new, what changed is that a ransomware group with 579 confirmed victims on their data leak site as of this month decided to operationalize it at scale.

Two weeks inside the network. During that time: command execution, process creation, LDAP and Active Directory enumeration, credential-based lateral movement, browser credential theft. All of it over connections your tools classified as Microsoft Teams relay traffic.

No patch from Microsoft fixes this. The company has not changed how TURN relay token issuance works, the technique abuses a legitimate feature, not a vulnerability. The advisory notes three CVEs, but the CVEs are not the story. The technique is.

What the industry is still pretending

We spend a lot of energy arguing about SIEM tuning, about alert fatigue, about the signal-to-noise ratio in the SOC. And those are real problems. But there is a quieter problem underneath them, one the DragonForce case makes visible: the entire detection model assumes attackers are bringing their own infrastructure.

When they borrow yours instead, the model breaks in a specific way. Not noisily, no cascade of alerts, no anomalous external domain, no flagged IP. It breaks silently. The monitoring keeps running. The approvals keep logging. The team keeps working through the queue. And somewhere in the middle of that, ransomware deploys and Backdoor.Turn gets injected into DbgView64.exe to maintain persistence after the encryption run.

The researcher presenting this at Area41 in Zurich on June 18 (Thibaut Passilly) described the tradecraft as “exceptionally sophisticated.” That is accurate. It is also, unfortunately, a template. If one affiliate group figured out that Microsoft Teams relay servers are a viable Microsoft Teams C2 channel that blends into legitimate infrastructure, others have already read the paper.

Defense here requires endpoint behavioral detection of the TeamsMediaRelay service, RWX memory anomalies in Teams.exe, and specific driver allowlist hygiene. Not a product announcement. A configuration posture that most organizations have not yet adopted, because until last week there was no public documentation of this technique being used in a live ransomware intrusion.

The part nobody is naming (du-du-du)

DragonForce is also doing something else. After deploying ransomware, they install Backdoor.Turn to maintain persistence. This suggests either a second-intrusion plan or they are selling access to the compromised host to other operators. The cartel structure they moved to in 2025 makes the latter commercially logical.

The intrusion is not over when the ransom note appears: the ransom note might be the beginning of the second chapter.

Two weeks of dwell time, 579 confirmed victims, C2 over infrastructure you actively trust, and a backdoor that survives the ransomware cleanup. The monitoring stack approved all of it..