OTX Threat: Attackers Weaponize Microsoft Teams Relays to Stay Hidden

Attackers deploying DragonForce ransomware against a major U.S. services firm concealed their command-and-control traffic within Microsoft Teams relay infrastructure using Backdoor.Turn, a custom Go-based remote access trojan. This novel technique leverages anonymous Teams visitor tokens and TURN relay servers to mask malicious communications as legitimate Microsoft traffic. The intrusion lasted o CVEs: CVE-2025-61155, CVE-2023-52271, CVE-2025-1055