Hackers Weaponize Microsoft Teams Relay to Hide Ransomware Traffic

Symantec uncovered a campaign in which the Backdoor.TURN Go-based RAT leveraged Microsoft Teams TURN relay servers to hide C2 communications during a DragonForce ransomware intrusion against a major U.S. services firm; attackers used DLL sideloading, abused vulnerable drivers (including HWAuidoOs2Ec.sys and other CVE-linked drivers), deployed a custom malicious driver to kill security processes, and conducted reconnaissance, credential theft, lateral movement, and long-term persistence.