DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

2026-06-19

DragonForce deployed a Go-based RAT called Backdoor.Turn against a major US services firm, hiding C2 traffic inside legitimate Microsoft Teams TURN relays and maintaining access for one to two months with a QUIC session to their real server.