Microsoft Teams users beware — relays hit by ransomware hackers looking to hide malicious traffic

Representational image of a cybercriminal.

• Symantec confirms DragonForce ransomware operators used Microsoft Teams TURN relays for covert C2 traffic
• Custom Go‑based RAT “Backdoor.Turn” masked malicious activity as normal Teams communications
• First in‑the‑wild use of “Ghost Calls” technique; campaign shows highly sophisticated tradecraft with Scattered Spider links

Experts have warned cybercriminals are using Microsoft Teams relays as command-and-control (C2) infrastructure, blending malicious traffic with benign corporate communications.