Ransomware gang abuses Microsoft Teams relays to hide malicious traffic

Symantec reports that the DragonForce ransomware operation used a custom Go RAT called Backdoor.Turn to hide C2 communications inside Microsoft Teams TURN relays during a December 2025 attack on a major U.S. services company; the attackers gained initial access (likely via an MSSQL/SQL flaw), sideloaded a malicious DLL, leveraged BYOVD vulnerable drivers and a custom malicious driver for kernel privileges and security tool termination, performed reconnaissance and credential theft, exfiltrated data, and deployed ransomware—Symantec published IoCs and detailed the sophisticated TTPs and links to Scattered Spider.