Actor Profile

DragonForce is a ransomware gang that has developed custom tooling to support their extortion operations. The group demonstrates advanced capabilities in developing bespoke malware and leveraging legitimate cloud infrastructure for command-and-control purposes. Their use of Backdoor.Turn indicates a focus on operational security and evasion, utilizing Microsoft Teams relay infrastructure to blend malicious traffic with legitimate enterprise communications. This approach suggests the actor prioritizes stealth and persistence in victim environments.

TTPs (Tactics, Techniques, Procedures)

DragonForce employs custom malware (Backdoor.Turn) for command-and-control operations, leveraging legitimate Microsoft Teams relay infrastructure to tunnel C2 traffic. This technique aligns with T1071.001 (Application Layer Protocol: Web Protocols) and T1090.004 (Proxy: Domain Fronting), using trusted cloud services to evade network-based detection. The use of a custom backdoor indicates T1587.001 (Develop Capabilities: Malware) and suggests the group maintains in-house development resources. The C2 obfuscation through Teams infrastructure enables T1573 (Encrypted Channel) by blending with legitimate encrypted traffic, complicating traffic analysis and signature-based detection.

Targets & Patterns

No specific targeted sectors or geographic regions are identified in the available data. However, the choice to abuse Microsoft Teams infrastructure suggests DragonForce likely targets organizations that use Microsoft 365 environments, where Teams traffic would appear legitimate and blend seamlessly with normal business communications. This technique would be most effective against enterprises with established Microsoft cloud deployments, where security teams may be less likely to scrutinize Teams-related network connections.

Historical Context

Limited historical context is available from the provided data. DragonForce's development of custom malware like Backdoor.Turn demonstrates evolution beyond commodity ransomware tools, indicating the group is investing in operational security and evasion capabilities. The use of legitimate cloud infrastructure for C2 follows a broader industry trend among sophisticated threat actors to abuse trusted services, similar to techniques observed in other ransomware operations and APT campaigns that leverage cloud platforms to evade detection.

Defensive Recommendations

  • Monitor for anomalous Microsoft Teams API usage and relay connections from systems that should not be running Teams clients, particularly servers and non-user endpoints (T1071.001)
  • Implement network traffic analysis to identify unusual patterns in Teams-related traffic, including connections from unexpected processes or high-volume data transfers inconsistent with normal collaboration activity
  • Deploy endpoint detection rules to identify processes spawning or injecting into Teams-related executables, or establishing network connections masquerading as Teams traffic (T1055)
  • Restrict outbound connectivity to Microsoft Teams infrastructure from servers and critical systems that do not require collaboration tools, reducing the attack surface for C2 tunneling
  • Enable enhanced logging for cloud application usage and correlate endpoint telemetry with cloud service logs to detect unauthorized use of Teams infrastructure for C2 purposes