DragonForce Ransomware Hides C2 in Microsoft Teams: 579 Victims and Counting

DragonForce's attack chain begins with initial access, escalates through BYOVD driver abuse, and culminates in a C2 channel that blends into legitimate Teams traffic before ransomware encryption.

Initial access exploited an unpatched SQL Server vulnerability in the U.S. victim environment. Symantec notes possible involvement of an access broker to acquire the initial foothold. Once inside, the threat actor downloaded additional tools from 192.36.27[.]51, including TechSupV18Fix3.zip.

Persistence and privilege escalation relied on DLL sideloading. The attackers dropped a malicious vboxrt.dll alongside a legitimate VirtualBox executable (DbgView64.exe), causing the target process to load attacker-controlled code. They then modified the Windows LimitBlankPassword policy, created malicious user accounts, and altered firewall rules to maintain access across reboots.

Defense evasion used four separate BYOVD techniques in a sequence known as a "Havoc Process Terminator" attack:

• Huawei HWAuidoOs2Ec.sys (novel technique, not previously seen in exploitation campaigns)
• Topaz Antifraud wsftprm.sys (CVE-2023-52271)
• Tower of Fantasy GameDriverx64.sys (CVE-2025-61155)
• K7 Security Anti-Malware K7RKScan.sys (CVE-2025-1055)

A fifth driver, ABYSSWORKER, is a custom malicious kernel driver that masquerades as a legitimate Palo Alto Networks driver to disable security tooling at ring-0 level. This mirrors the AI-assisted ransomware EDR evasion toolkits documented in other active campaigns this year.

Command and control via Backdoor.Turn is the novel capability in this attack. The backdoor requests a visitor token from Microsoft's Skype-backed identity services, uses that token to interact with Teams-associated TURN relay infrastructure, and then establishes a QUIC session to the attacker's actual C2 server. The entire C2 channel traverses legitimate Microsoft IP space. Backdoor.Turn's capabilities include command execution, process creation, network scanning, TLS certificate capture, LDAP and Active Directory enumeration, lateral movement via stolen credentials, and browser credential theft. The backdoor was deployed after the ransomware encryption, suggesting it is intended for persistent re-access to already-compromised organizations.

DragonForce has claimed 579 confirmed victims since its June 2023 launch, with activity accelerating sharply after RansomHub's collapse in 2025 caused a significant migration of affiliates to competing RaaS platforms.

The group posted its peak victim count of 35 in December 2025, the same month the Backdoor.Turn attack on the U.S. services company was conducted. From December 2023 through January 2026, 363 organizations appeared on the DragonForce data leak site. From January to June 2026, the count reached 579, indicating roughly 216 additional victims in under six months.

DragonForce targets organizations with annual revenues above $15 million and focuses affiliate activity on manufacturing, construction, IT services, healthcare, and retail. The group does not pursue opportunistic low-value targets. Each affiliate pays 0% to 23% of ransom proceeds to the DragonForce cartel operation, substantially below the 20% standard fee charged by most RaaS platforms, making it attractive to experienced operators targeting high-value organizations.

The DragonForce ransomware campaign's most public confirmed attack was the breach of UK retailer Marks & Spencer (M&S) in 2025, carried out via the Scattered Spider threat group operating DragonForce tooling. The M&S CEO received direct ransom demands. The attack caused significant disruption to the retailer's online operations, payment systems, and internal HR platforms across the United Kingdom.

The Netherlands saw a surge of DragonForce victims in May 2026, with the group claiming more than half of all Dutch ransomware victims in a single month. This geographic expansion beyond its historical concentration in English-speaking markets signals active affiliate recruitment and campaign scaling. Sector targeting matches the profile of organizations in RaaS franchise operations like The Gentlemen ransomware: mid-market to enterprise, with identifiable publicly exposed edge infrastructure.

DragonForce's attack against the U.S. services firm maps across the full MITRE ATT&CK framework from initial access through impact, with novel techniques at the defense evasion and command-and-control phases.

Initial Access (T1190): Exploitation of a public-facing SQL or MSSQL server vulnerability. Exact CVE not publicly attributed. Possible access broker involvement.

Execution (T1059): Backdoor.Turn provides arbitrary command execution and process creation on compromised hosts via the QUIC-tunneled TURN relay channel.

Persistence (T1547, T1136): Modified LimitBlankPassword Windows registry policy, created new user accounts and groups, altered firewall rules, deployed Backdoor.Turn as a Windows service named "TeamsMediaRelay."

Privilege Escalation and Defense Evasion (T1068, T1014, T1574.002): Four BYOVD drivers plus custom ABYSSWORKER kernel driver terminate EDR processes at ring-0. DLL sideloading via malicious vboxrt.dll injected through legitimate VirtualBox and DbgView processes.

Discovery (T1069, T1087, T1018, T1046): LDAP and Active Directory searches enumerate all domain users and groups. Network scanning identifies lateral movement targets. TLS certificate collection maps external infrastructure.

Credential Access (T1555.003): Browser credential theft via Backdoor.Turn capabilities targeting stored passwords in Chrome, Edge, and Firefox.

Lateral Movement (T1021): Credential-based domain traversal using stolen credentials from browser vaults and LDAP enumeration.

Command and Control (T1071.001, T1572): Backdoor.Turn's TURN relay abuse sends all C2 through legitimate Microsoft IP ranges. QUIC protocol tunneling on the TURN relay connection makes protocol-based detection ineffective.

Impact (T1486): DragonForce ransomware locker deployed post-reconnaissance for domain-wide encryption.

The behavioral profile of the BYOVD sequence closely matches techniques documented in the Windows Netlogon RCE domain controller attack chain, where attackers use driver-level access to disable monitoring before lateral movement through domain infrastructure.

Security teams should ingest all indicators below into SIEM, EDR, network detection, and threat intelligence platforms immediately. These indicators were published by Symantec on June 16, 2026, and represent confirmed artifacts from the December 2025 attack against a U.S. services organization.

Behavioral detection priority: Hunt for any Windows service named "TeamsMediaRelay" installed outside of your sanctioned IT change management process. Any instance is a confirmed Backdoor.Turn installation. Outbound TCP connections from within Teams.exe to Microsoft's known IP ranges on non-standard ports (not 443 or 80) indicate active C2 activity. RWX (read-write-execute) memory pages within the Teams.exe process space are an injection indicator.

Registry artifact: Unusual modification to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services: specifically a new service entry for "TeamsMediaRelay" with an executable path pointing to a non-standard location.

C2 infrastructure note: The listed C2 domains are attacker-controlled redirect targets, not Microsoft infrastructure. Traffic will appear to originate from legitimate Microsoft TURN relay IPs before reaching these domains.

DragonForce selects targets with deliberate criteria, not opportunistic mass scanning. The revenue threshold of $15 million annually filters out small businesses but places mid-market companies squarely in the primary target band alongside enterprises.

Manufacturing faces the highest confirmed victim concentration in the DragonForce data leak site. Operational technology environments typically have longer patching cycles and more legacy systems, creating a broader attack surface. A successful DragonForce intrusion in manufacturing can halt production lines, lock engineering workstations, and encrypt operational data needed for safety systems.

Healthcare organizations present both revenue targets and high ransom payment incentive. Patient care systems create pressure for rapid ransom payment decisions. DragonForce affiliates specifically seek healthcare organizations where operational disruption creates clinical risk, increasing leverage.

IT services and managed service providers (MSPs) represent multiplier targets: a single MSP compromise can provide access to dozens of downstream client environments. The SimpleHelp RMM exploitation campaign DragonForce ran in early 2025 demonstrated this approach, using a vulnerable remote monitoring tool to pivot through MSP infrastructure into client networks.

Retail entered DragonForce's confirmed targeting with the M&S attack and subsequent Netherlands surge in May 2026. Retail organizations carry high volumes of customer payment card data, health and contact information, and loyalty program databases that command high values on dark web markets.

Your immediate exposure checklist:

• Do you run any public-facing SQL Server or MSSQL endpoints?
• Has your organization deployed Microsoft Teams across all employee endpoints?
• Are your BYOVD driver-capable detection rules current for Topaz, Tower of Fantasy, K7, and Huawei drivers?
• Can you detect a new Windows service named "TeamsMediaRelay" being installed on any endpoint?
• Are your EDR exclusions audited for attacker-added entries?

The following steps address the specific attack chain components Symantec confirmed in the December 2025 intrusion. Complete all steps before end of day.

DragonForce's Backdoor.Turn changes the threat model for every organization that has deployed Microsoft Teams. The assumption that outbound network monitoring can catch C2 communications by detecting connections to known-malicious infrastructure no longer holds when the C2 channel rides on legitimate Microsoft TURN relay IP addresses.

Three capabilities enabled by Backdoor.Turn that defenders did not face before this disclosure: First, full C2 functionality including command execution, network scanning, AD enumeration, and lateral movement through a channel that will never appear in threat intelligence feeds as malicious infrastructure. Second, persistence via a legitimate-looking Windows service that survives reboots and generates no suspicious file system activity. Third, dwell times measured in months before detection, because there are no suspicious outbound connections to alert on.

The DragonForce ransomware campaign's 579 confirmed victims represent the minimum observable number. Organizations whose data has been exfiltrated but who have not yet received a ransom demand, and organizations where Backdoor.Turn is deployed for re-access after a prior paid ransom, will not appear in published victim counts.

The immediate defensive priority is behavioral detection. Network indicators will not catch Backdoor.Turn. Endpoint behavioral indicators: the TeamsMediaRelay service, RWX pages in Teams.exe, unusual LDAP queries from Teams-associated processes: are the detection surface that matters. Load the IOCs from this post into your SIEM and EDR platforms today. Run the service hunt across your endpoint fleet before the end of the business day. DragonForce's operators have spent months demonstrating that 1-2 month dwell times are achievable when detection relies on network monitoring alone.