Crooks found a new way to collaborate using Teams – by hiding command-and-control traffic

Symantec researchers observed a campaign where DragonForce operators (linked to Scattered Spider affiliates) compromised a major US services company, deployed DragonForce ransomware and a custom Go backdoor called Backdoor.Turn, and hid C2 traffic by piggybacking on Microsoft Teams infrastructure (using anonymous Teams tokens, Microsoft-operated TURN relays, and QUIC) so network monitors saw only legitimate Teams traffic, enabling prolonged access and potential data exfiltration or resale.