42
55
30
30
55
57
60
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Symantec and Carbon Black found DragonForce-linked hackers using Backdoor.Turn, a Go RAT tunneling C2 through Microsoft Teams TURN relays via QUIC.
Broadcom's Symantec and Carbon Black documented Backdoor.Turn, a Go-based RAT associated with the DragonForce ransomware group, deployed at a major U.S. services firm where attackers remained on the network for one to two months. The backdoor obtains an anonymous Teams visitor token from Microsoft's Skype-backed identity services, uses a legitimate Microsoft TURN relay for connection setup, and runs a QUIC session to the attacker's C2 server, so defenders see only outbound traffic to legitimate Teams servers. Initial access is suspected to involve exploiting a SQL/MS-SQL vulnerability or an access broker, followed by a PowerShell-dropped ZIP, DLL side-loading, and BYOVD evasion using a Huawei driver; the RAT is injected into DbgView64.exe after DragonForce ransomware deployment for continued access. First publicly documented TURN abuse by the group, it leverages Praetorian's Ghost Calls technique and supports command execution, network scanning, LDAP/AD search, lateral movement, and browser credential theft.
72
60
42
42
42
42
42
42
60
42
30
42
47
55
42
KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension
Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.
Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.
52
42
30
42
60
30
30
30
42
42
47
42
47
55
60
42
SolarWinds Web Help Desk Exploited for RCE in Multi
60
55