DragonForce ransomware hides C2 in Microsoft Teams TURN relays
Researchers found DragonForce’s custom Go RAT, Backdoor.Turn, piggybacking on Microsoft Teams’ TURN relay protocol to disguise command‑and‑control traffic as legitimate Teams traffic. This technique lets the gang evade network defenses and stay hidden within trusted Microsoft infrastructure, raising alarm for any organization that relies on Teams for communications.