How Ransomware Can Hide in Microsoft Teams Traffic
A ransomware group just figured out how to disguise its command-and-control communications as ordinary Microsoft Teams traffic. If your first reaction is “our firewall would catch that,” you are, respectfully, proving their point.
As SecurityWeek reported earlier this month, threat researchers at Symantec and Carbon Black have published their analysis of a new backdoor called Backdoor.Turn, deployed by the DragonForce ransomware group in an attack on a US services firm. The malware is written in Go and does something that, to the best of anyone’s knowledge, no malware has done before. It obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay server to establish its connection, and runs an encrypted QUIC session through that relay back to the attackers’ real command-and-control infrastructure. Your security tools see Teams traffic going to Microsoft servers. The attackers see an open channel to your data.
To understand why this matters, you have to understand how most organizations structure their network defenses. We build allowlists. We designate certain domains, IP ranges, and cloud services as “known safe” and concentrate our monitoring resources on everything else. Microsoft’s infrastructure sits at the top of virtually every one of those lists, and for good reason. Hundreds of millions of people use Teams, Outlook, SharePoint, and Azure services every workday. The traffic is constant and voluminous. Flagging all of it for deep inspection would grind business operations to a halt. So we trust it.
But trust, in cybersecurity, is always a calculated risk. The platforms you depend on most heavily are also the ones whose compromise would be hardest to detect, which is why ongoing vendor risk assessment is essential rather than optional. DragonForce just demonstrated what happens when that calculus is taken for granted.
When Ransomware Groups Start Doing R&D
The sophistication of this attack signals something broader about where ransomware operations are heading. The group didn’t cobble together existing tools or repurpose commodity malware from a dark web marketplace. They wrote a custom backdoor, in a compiled language, engineered specifically to exploit the trust relationship between enterprise security tools and Microsoft’s cloud infrastructure. The Symantec and Carbon Black researchers note that this is the first known malware family to abuse Microsoft’s TURN relay infrastructure in this way. That distinction matters. It tells us that ransomware operators are investing in genuine research and development, building original capabilities rather than iterating on last year’s playbook. When criminal organizations start doing R&D, the rest of us need to urgently revise and update our assumptions.
The attack itself was methodical and patient. The initial compromise of the target firm likely came through a vulnerability in a SQL server, and the attackers may have purchased their initial foothold from an access broker rather than finding it themselves. Once inside, they used DLL sideloading to fetch additional payloads from remote servers. They deployed a bring-your-own-vulnerable-driver (BYOVD) strategy, exploiting known flaws in legitimately signed drivers to gain kernel-level access, which allowed them to disable the target’s security processes directly. They conducted network reconnaissance and LDAP/Active Directory mapping. They moved laterally using stolen credentials. They exfiltrated credentials from browsers on compromised machines. And only then did they deploy both the DragonForce ransomware for encryption and data exfiltration, and the Backdoor.Turn malware to maintain persistent access long after the initial attack was discovered. The backdoor was not an afterthought or a contingency plan. It was the long game.
For anyone running a small or mid-sized business, the temptation is to file this under “enterprise-scale problem.” That temptation should be resisted. Ransomware groups have been operating as service providers for years, licensing their tools and infrastructure to affiliates who select targets based on opportunity rather than company size. DragonForce specifically operates as a cartel, a structure designed for scale and broad distribution. The techniques that make Backdoor.Turn effective work just as well against a 50-person professional services firm as they do against a Fortune 500 company. All you need is a Microsoft 365 deployment, an internet-facing SQL server, and a security posture built on the assumption that traffic to Microsoft is safe traffic. That description covers a staggering number of businesses in operation today, many of which are already grappling with the security risks of shadow IT and unsanctioned tool use. This attack adds a dimension that most shadow IT strategies don’t account for: the tools on your approved list being turned against you.
What This Means for Your Defenses
First, recognize that allowlist-based network monitoring has real limits. Traffic going to known-safe destinations still needs behavioral analysis. If a workstation that has never initiated a Teams relay connection suddenly starts doing so at 2 a.m., or a machine with no history of QUIC protocol use begins generating encrypted sessions to Microsoft relay servers, those are the kinds of anomalies that matter. Catching them requires tools and analysts capable of spotting deviations from baseline behavior, not simply matching against signatures of known threats.
Second, your endpoint detection is only as good as its ability to keep running. BYOVD attacks exist specifically to disable security processes at the kernel level, before they can raise an alarm. Defense in depth means building your security architecture on the assumption that any single layer, including the one you trust most, can be defeated.
Third, and most fundamentally, someone needs to be watching. Automated tools are essential, but a dashboard full of green lights on “legitimate” Microsoft traffic is not going to flag itself. Threat hunting, the deliberate, ongoing search for indicators of compromise within traffic that looks perfectly normal, is no longer a luxury reserved for enterprises with dedicated SOC teams. For businesses of every size, it is the work.
At TMG, this is exactly the kind of evolving threat we make it a priority to discuss with our clients, because developments like this one change the threat model. When the traffic your defenses were built to trust becomes the attack vector, the question shifts from “do we have the right tools?” to “do we have people who understand what they’re looking at?” We help businesses build security programs that assume no single layer is impervious, and we provide the behavioral analysis and threat hunting that turn a wall of green lights into actionable intelligence.
The assumption that trusted traffic is “safe traffic” was always a convenient shorthand. As of this month, it is a documented attack vector.