DragonForce ransomware group hides command-and-control traffic inside Microsoft Teams communications

Cybercrims deploying DragonForce ransomware appear to have gained access to a major US services company's network, then spent two months up to no good while disguising their command-and-control activities as legitimate Microsoft Teams traffic.

Researchers at security firm Symantec said the intrusion began with attackers gaining access to the victim's environment before deploying a custom Go-based backdoor, tracked as 'Backdoor.Turn,' to maintain communication with the compromised systems.

Rather than reaching out to attacker-controlled infrastructure, the malware routed communications through legitimate Microsoft services, making malicious activity look like routine corporate collaboration.