MalwarePublished 17 Jun 2026

Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack

Source SecurityWeek

Description

The attackers deployed a new Go-based backdoor that uses Microsoft Teams servers for command-and-control. The post Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack appeared first on SecurityWeek .

Impact

The impact includes unauthorized persistent access to victim networks, execution of arbitrary commands, network reconnaissance, lateral movement, credential theft, and data exfiltration. The use of legitimate Microsoft Teams infrastructure for C&C traffic complicates detection and response efforts. Victims suffer from ransomware encryption and potential data loss or exposure. The attack chain involves kernel-level access, which can disable security controls and increase the difficulty of remediation.

Defensive guidance

Since this attack abuses legitimate Microsoft Teams infrastructure rather than exploiting a vulnerability in Teams itself, no direct patch for Teams is indicated. Organizations should focus on securing initial entry points such as SQL/MSSQL servers, monitor for DLL sideloading and kernel-level exploits, and employ detection techniques for anomalous use of Microsoft Teams tokens or unusual network traffic patterns. Incident response should include credential resets and thorough network investigation. Vendor-managed cloud services like Microsoft Teams are typically patched server-side by Microsoft; however, this threat leverages legitimate service features rather than a vulnerability in the service.

References

securityweek.com/microsoft-teams-relay-servers-abused-in-dragonforce-ransomware-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Jun 2026, 10:45 UTC

References

Community reviews

Related threats