DragonForce Ransomware & Backdoor.Turn — Microsoft Teams TURN-Relay C2

DragonForce is a ransomware operation (active since mid-2023, tracked by Symantec under the Hackledorb group) that has matured from a standard ransomware-as-a-service model into a formalized "cartel" affiliate structure. In a recently disclosed intrusion against a major U.S. services firm, affiliates paired the ransomware with a previously unseen, custom Go-based remote access trojan that Symantec named Backdoor.Turn.

Backdoor.Turn's defining trait is its command-and-control evasion. Rather than beaconing directly to attacker infrastructure, it requests an anonymous Teams "visitor" token from Microsoft's Skype-backed identity services, uses a legitimate Microsoft TURN relay (Traversal Using Relays around NAT) to set up the connection, and then establishes a QUIC session to the attacker's real C2 through that relay. To a network defender, the only visible traffic is outbound connections to legitimate Microsoft Teams/Skype servers — there is no rogue domain or IP on the wire. Symantec assesses this as the first known in-the-wild abuse of TURN-relay infrastructure for C2; the underlying technique was publicly documented by Praetorian as "Ghost Calls" (2024).

For stealth, Backdoor.Turn is injected into the legitimate Sysinternals DbgView64.exe (DebugView) process, and is deployed after the DragonForce ransomware itself is staged — suggesting the operators use it as a resilient post-encryption foothold. Its capabilities include command execution, process creation, network scanning (TLS-cert and web-page-title harvesting), LDAP / Active Directory search, credential-based lateral movement, and browser credential theft. The broader intrusion also featured DLL side-loading (via VirtualBox and other ZIP-packaged lures) and extensive Bring-Your-Own-Vulnerable-Driver (BYOVD) abuse to disable security tooling.

Decisions: Unlike many fresh disclosures, Symantec published a rich atomic IOC set (Backdoor.Turn + shellcode hashes, a dedicated C2 IP, C2 domains, BYOVD driver hashes, a staging URL). Those are carried verbatim into §4/§10 with provenance. Because the live C2 channel is network-invisible (it rides legitimate Microsoft Teams/Skype + TURN), the strongest behavioral anchors are endpoint-side: the legitimate DbgView64.exe behaving abnormally (network egress, odd path), injection into it, Go-binary recon (LDAP/AD + network scanning), browser-credential file access, and DragonForce mass-encryption. We label atomic threat-intel IOCs vs behavioral hunt artifacts explicitly. Note on dates: reporting dates the public disclosure to 2026-06-16; this pack is generated 2026-06-19.

Working hypothesis: An affiliate gains initial access (Symantec suspects SQL/MSSQL exploitation or an initial-access broker), conducts AD/network reconnaissance, disables defenses with BYOVD, deploys DragonForce ransomware, and then plants Backdoor.Turn — injected into a legitimate DbgView64.exe — as a stealthy post-encryption foothold whose C2 hides inside Microsoft Teams/Skype + TURN-relay traffic and exits via QUIC to the attacker. EDR sees the host-side behavior even though the network sees only Microsoft.

Hunt hypotheses (fidelity-ordered)

• H1 (high): The legitimate DbgView64.exe makes outbound network connections or runs from a non-standard path → Q1. DebugView is an interactive GUI tool with no benign reason to egress.
• H2 (high): A process opens DbgView64.exe with injection rights / creates a remote thread in it → Q2 (the host-side signature of the RAT plant).
• H3 (high): A Go-compiled binary from a user-writable / unusual path performs LDAP/AD queries (port 389/636) → Q3.
• H4 (med): A non-Teams/non-browser process makes UDP/3478 (STUN/TURN) connections, or heavy QUIC (UDP/443) from an unexpected image → Q4.
• H5 (med): A single process connects to many internal hosts in a short window (network scan fan-out) → Q5.
• H6 (high): A single process renames/writes a large number of files rapidly (ransomware mass-encryption) → Q6.
• H7 (high): A known-vulnerable driver (BYOVD hash/filename) is written to disk → Q7.
• H8 (med): A non-browser process reads browser credential stores (Login Data / cookies) → Q8.

Grouped IOC Quick-Copy

Atomic IOCs are from Symantec/Broadcom + The Hacker News (§18) — every value below traces to those reports. Behavioral signatures are hunt artifacts, not atomics. Do not auto-block the C2 domains blindly (some may be compromised legit sites) — detect first, then verify.

type,value,action,severity,expiration,description,tags
sha256,821da79d727351dd67ce5df7950e9a3de6647a3cf474bb3a093f67507fed92a6,prevent,critical,2027-06-19,Backdoor.Turn sample,campaign:DragonForce-BackdoorTurn
sha256,048e18416177de2ead251abdf4d89837f6807c6aba4d5b1debe49adfdecbf05c,prevent,critical,2027-06-19,Backdoor.Turn sample,campaign:DragonForce-BackdoorTurn
sha256,ce66b8221446c9b6d83f0ce6382f430e519601641e5daaaf1ca7a8a8806cb0b0,prevent,critical,2027-06-19,Backdoor.Turn shellcode,campaign:DragonForce-BackdoorTurn
sha256,82b37a92589dfd4d67ca87eb9e52ac8e682e8e60d2211f59074cd5ccc693013b,prevent,high,2027-06-19,Downloader / related,campaign:DragonForce-BackdoorTurn
sha256,e45b18c93d187aac5c4486f57483bc87580e15def82a312bfb377ff16eb96b22,prevent,critical,2027-06-19,DragonForce ransomware,campaign:DragonForce-BackdoorTurn
sha256,6f9fbe29f8cc2788e2bc9d631e0eea2a8e9837076837b55838005a0e654f0a9e,prevent,high,2027-06-19,AV killer,campaign:DragonForce-BackdoorTurn
ipv4,62.164.177.25,detect,high,2026-09-19,Backdoor.Turn real C2,campaign:DragonForce-BackdoorTurn
ipv4,192.36.27.51,detect,high,2026-09-19,Staging host (TechSupV18Fix3.zip),campaign:DragonForce-BackdoorTurn
domain,socialbizsolutions.com,detect,medium,2026-09-19,C2 / infrastructure,campaign:DragonForce-BackdoorTurn
domain,turnkeyaiagents.com,detect,medium,2026-09-19,C2 / infrastructure,campaign:DragonForce-BackdoorTurn
domain,mysimerp.net,detect,medium,2026-09-19,C2 / infrastructure,campaign:DragonForce-BackdoorTurn

b6628d201c2a68d2a3de2a87de7a5acfe21b101a97928e1c8d5c82102d967383  # GameDriverx64 (Tower of Fantasy) CVE-2025-61155
252a8bb2eb9c96c5e6cc7cab822e2ed0d508032f9350351221781684e86c03ab  # Topaz Antifraud wsftprm.sys CVE-2023-52271
b16e217cdca19e00c1b68bdfb28ead53b20adeabd6edcd91542f9fbf48942877  # K7 Security K7RKScan.sys CVE-2025-1055
8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531  # Huawei HWAuidoOs2Ec.sys (Havoc Process Terminator)
8284c8676cc22c4b2e66826ac16986da7ddecba1f2776b16771be17bfdc45dc2  # ABYSSWORKER driver
65ab49119c845801f29a57e8aa177146b2ffbd289d4278109b146f933380f951  # ABYSSWORKER driver
# Filenames seen: HWAuidoOs2Ec.sys, wsftprm.sys, GameDriverx64.sys, K7RKScan.sys (ABYSSWORKER masqueraded as Palo Alto)

62.164.177.25                         # Backdoor.Turn real C2 endpoint
http://192.36.27.51/TechSupV18Fix3.zip  # malicious staging download
projetosmecanicos.com.br
socialbizsolutions.com
professionalhomebasedbusiness.com
safefire.jo
glanz-gmbh.de
turnkeyaiagents.com
comunidadesparentais.com.br
mysimerp.net
# Note: live C2 also rides legitimate MS Teams/Skype + TURN relay (UDP 3478) + QUIC (UDP 443) - not blockable on the wire

Legitimate DbgView64.exe (Sysinternals DebugView) making outbound network connections or running from an unusual path
Process injection / CreateRemoteThread into DbgView64.exe (Backdoor.Turn plant)
Non-Teams / non-RTC process sourcing UDP/3478 (STUN/TURN) or anomalous QUIC (UDP/443) egress
Go-compiled binary from a user-writable path performing LDAP/AD queries (389/636/3268/3269)
Single process fanning out to many internal hosts in a short window (network scanning, TLS-cert/title harvest)
Single process writing/renaming many files in minutes (DragonForce mass encryption) + ransom note write
Known-vulnerable BYOVD driver (.sys) written to disk before being loaded to disable AV/EDR
Non-browser process reading browser credential stores (Login Data / Cookies / logins.json / key4.db)

STIX-style JSON (campaign indicators)

{
  "campaign": "DragonForce-BackdoorTurn",
  "disclosed": "2026-06-16",
  "source": "Broadcom/Symantec + Carbon Black; The Hacker News",
  "indicators": {
    "sha256_backdoor_turn": [
      "821da79d727351dd67ce5df7950e9a3de6647a3cf474bb3a093f67507fed92a6",
      "048e18416177de2ead251abdf4d89837f6807c6aba4d5b1debe49adfdecbf05c",
      "ce66b8221446c9b6d83f0ce6382f430e519601641e5daaaf1ca7a8a8806cb0b0"
    ],
    "sha256_dragonforce_ransomware": ["e45b18c93d187aac5c4486f57483bc87580e15def82a312bfb377ff16eb96b22"],
    "sha256_byovd_drivers": [
      "b6628d201c2a68d2a3de2a87de7a5acfe21b101a97928e1c8d5c82102d967383",
      "252a8bb2eb9c96c5e6cc7cab822e2ed0d508032f9350351221781684e86c03ab",
      "b16e217cdca19e00c1b68bdfb28ead53b20adeabd6edcd91542f9fbf48942877",
      "8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531",
      "8284c8676cc22c4b2e66826ac16986da7ddecba1f2776b16771be17bfdc45dc2",
      "65ab49119c845801f29a57e8aa177146b2ffbd289d4278109b146f933380f951"
    ],
    "ipv4_c2": ["62.164.177.25"],
    "ipv4_staging": ["192.36.27.51"],
    "domains_c2": [
      "socialbizsolutions.com", "turnkeyaiagents.com", "mysimerp.net",
      "safefire.jo", "glanz-gmbh.de", "professionalhomebasedbusiness.com",
      "projetosmecanicos.com.br", "comunidadesparentais.com.br"
    ],
    "injection_host_process": "DbgView64.exe",
    "c2_technique": "Teams visitor token -> Microsoft TURN relay -> QUIC to attacker C2 (Ghost Calls)"
  }
}

DragonForce + Backdoor.Turn touches Windows endpoints, Active Directory, MSSQL, and Microsoft 365/Teams policy. The novel C2 cannot be blocked on the wire, so hardening focuses on denying the foothold (driver/injection controls), reducing recon & lateral-movement value, and tightening Teams anonymous-join.

Playbook A · Find & triage abnormal DbgView64.exe (Windows, PowerShell)

# 1. Locate every DbgView64.exe on the host and verify Sysinternals signature
Get-ChildItem -Path C:\ -Recurse -Filter DbgView64.exe -EA SilentlyContinue |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    [pscustomobject]@{ Path=$_.FullName; Signer=$sig.SignerCertificate.Subject; Status=$sig.Status; SHA256=(Get-FileHash $_.FullName -Algorithm SHA256).Hash }
  }

# 2. Is a DbgView64.exe currently running, and does it own any TCP/UDP endpoints? (DebugView normally does NOT)
$p = Get-Process DbgView64 -EA SilentlyContinue
if ($p) { Get-NetUDPEndpoint -OwningProcess $p.Id -EA SilentlyContinue; Get-NetTCPConnection -OwningProcess $p.Id -EA SilentlyContinue }
# Any network ownership by DbgView64.exe = escalate (likely Backdoor.Turn). Capture memory before killing.

Playbook B · Enable the Microsoft Vulnerable Driver Blocklist & harden MSSQL (registry / T-SQL)

# Enable HVCI / Microsoft vulnerable-driver blocklist (Win 11 / Server 2022+)
# HKLM\SYSTEM\CurrentControlSet\Control\CI\Config
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f
# Verify: Get-CimInstance Win32_DeviceGuard

# Disable xp_cmdshell on MSSQL (suspected initial access vector)
# EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
# EXEC sp_configure 'xp_cmdshell', 0;          RECONFIGURE;
# Then patch the instance and least-privilege the SQL service account.

Playbook C · Restrict TURN/QUIC egress to Teams & RTC only (Windows Firewall, illustrative)

# Block UDP/3478 (STUN/TURN) for all programs EXCEPT the Teams client (scope per your RTC app set).
# Apply via GPO so only sanctioned RTC images can source TURN; everything else is denied + logged.
New-NetFirewallRule -DisplayName "Deny TURN egress (non-Teams)" -Direction Outbound `
  -Protocol UDP -RemotePort 3478,5349 -Action Block -Profile Any
# Then add narrower Allow rules scoped to the Teams / Webex / Zoom executables you sanction.
# Force QUIC (UDP 443) fallback to TCP where you need inspection:
#   set DefaultJavaScript... not applicable here - instead block UDP/443 egress except for sanctioned apps.

Validation gates: (1) confirm NetworkConnectIP4 retains ContextImageFileName + Protocol_decimal and that injection telemetry is enabled fleet-wide; (2) Q1/Q2 return zero hits in a 30-day benign lookback after debugger/security exclusions; (3) import §10 atomics and verify no benign hash/filename collisions; (4) lab-validate Q1 stays quiet on benign DebugView and Q2 lineage fires on a benign cross-process opener — never the live RAT; (5) promote Q1/Q2 to Custom IOA Detect+Block (target FP < 1/week). The TURN/QUIC C2 step is an accepted detection gap on the network — mitigated by endpoint hunts (Q1/Q2), Teams anonymous-join hardening, and TURN/QUIC egress control.

HuntPack v0.1 · DragonForce Ransomware & Backdoor.Turn (MS Teams TURN-relay / QUIC C2) · Generated 2026-06-19 · Defensive use only — no offensive code. The live C2 is network-invisible (it rides legitimate Microsoft Teams/Skype + TURN relay); the durable detections are endpoint-side (DbgView64 anomaly + injection) plus the published atomic IOCs. Every atomic IOC traces to Symantec/Broadcom or The Hacker News (§18); validate field names and allow-lists in your tenant before promoting any query to alerting.