DragonForce ransomware abuses Microsoft Teams relay servers for command and control
THE BRIEF
Researchers observed a DragonForce ransomware intrusion using a Go-based backdoor that relied on Microsoft Teams relay infrastructure for command-and-control. By routing malicious communications through a widely trusted service, the attackers reduced the usefulness of simple domain blocking and made traffic appear more legitimate.
WHY IT MATTERS
Trusted cloud services are increasingly abused as attacker infrastructure. Defenders need behavioural monitoring and endpoint context rather than relying only on domain reputation.
WHO SHOULD CARE
SOC teams, Microsoft 365 administrators and ransomware defenders.
WHAT TO DO NOW
- Monitor unusual Teams-related outbound patterns
- Correlate cloud traffic with endpoint behaviour
- Review ransomware lateral-movement controls
VERIFICATION NOTE
Backfilled historical brief from a named primary or established reporting source.
