Cybercriminals mask malicious communications through Microsoft Teams relays

DragonForce, a ransomware-as-a-service group, conducted an intrusion against a U.S. services company that used DLL sideloading, BYOVD kernel-driver abuse, and a custom RAT called Backdoor.Turn which hid C2 traffic inside Microsoft Teams TURN relay infrastructure; attackers performed reconnaissance, credential theft, exfiltration and deployed ransomware, and Symantec published IoCs for detection and response.