Cybersecurity researchers have uncovered a concerning new tactic employed by the notorious DragonForce hacking group. The group has been found abusing Microsoft Teams’ built-in relay functionality to conceal their malicious backdoor traffic, making it harder for security teams to detect and mitigate their attacks.
DragonForce Exploits Microsoft Teams Relays
According to a report from NetworkUstad’s cybersecurity division, DragonForce hackers have been using the legitimate communication channels within Microsoft Teams to mask their command-and-control (C2) traffic. By routing their malware’s network communications through the Teams relay infrastructure, the attackers are able to blend in with normal collaboration and file-sharing activity, evading traditional security monitoring and detection methods.
Hiding Backdoors in Plain Sight
The researchers explained that DragonForce’s tactics involve infecting target systems with a custom backdoor that is capable of establishing an outbound connection to the hackers’ own C2 servers. However, instead of directly communicating with these servers, the malware is programmed to relay the traffic through the Microsoft Teams network, making it appear as legitimate collaboration data.
Impact on Enterprise Security
This abuse of Microsoft Teams’ built-in functionality poses a significant challenge for enterprise security teams. Many organizations have come to rely on Teams as a core productivity and communication tool, and securing these collaboration platforms has become a top priority. By hijacking the trust placed in Teams, DragonForce is able to bypass security controls and maintain persistent access to infected systems.
Recommendations for Defenders
Cybersecurity experts advise organizations to closely monitor and audit their Microsoft Teams deployments, looking for any suspicious traffic patterns or anomalous behavior that could indicate the presence of DragonForce’s backdoor. they recommend using reliable endpoint protection, network segmentation, and user awareness training to mitigate the risks posed by this new attack vector.
Ongoing Investigations and Mitigation Efforts
NetworkUstad has reached out to Microsoft for comment on the issue, and the company has confirmed that it is actively investigating the matter and working on potential solutions to address the abuse of Teams’ relay functionality. Meanwhile, cybersecurity firms and law enforcement agencies are collaborating to track down and disrupt the DragonForce hacking group’s operations.
