DragonForce Ransomware Exploited Microsoft Teams to Hide in Attack Against Major Company

Researchers reported that in 2025 a DragonForce ransomware campaign against a major US services firm used a Go-based RAT (Backdoor.Turn) to hide command-and-control traffic via Microsoft Teams TURN relays, exploited an undocumented Huawei driver vulnerability, removed security controls and created accounts for persistence, performed credential theft and lateral movement, exfiltrated data and ultimately deployed ransomware to encrypt victim machines.