DeepFalcon — Daily Threat Intelligence Report

Threat Landscape Summary — June 17, 2026

One qualifying critical finding for June 17 — a genuine first-of-its-kind LotL technique. Symantec disclosed that the DragonForce ransomware operation deployed a custom Go-based backdoor called Backdoor.Turn during an intrusion at a U.S. services company, abusing Microsoft Teams' own TURN relay infrastructure to disguise command-and-control traffic as legitimate Teams network activity. This is the first documented in-the-wild abuse of TURN relay infrastructure for malware C2 — researchers note the concept was only theorized in 2025 security research before this. The attackers maintained undetected access for roughly two months, using browser credential theft, Active Directory enumeration, and a malicious driver disguised as Palo Alto Networks software before deploying ransomware. Full IOCs have been published by Symantec. A second item worth awareness — a Kaspersky-discovered Steam Workshop malware campaign abusing the Wallpaper Engine application — is documented in Strong Leads below given its relevance to employee BYOD and personal-device risk.

> Coverage windowJun 16 3:30 PM — Jun 17 7:30 AM ET

> Category A qualifying findings0

> Category B (LotL) qualifying findings1 — DragonForce / Backdoor.Turn

> Threat actorDragonForce (RaaS, linked to Scattered Spider)

> DisclosureSymantec, June 16

> Strong Leads (Section 11)1 — Steam Workshop / Wallpaper Engine

CRITICAL ★ DragonForce Ransomware Weaponizes Microsoft Teams TURN Relay Infrastructure for Covert C2 — First Documented In-the-Wild Abuse of Teams Relay Servers for Malware Command and Control — Custom Backdoor.Turn RAT — Two-Month Undetected Intrusion Critical 🔧 LotL / Trusted Infra Abuse 💀 Ransomware ▼

Threat Actor

DragonForce — ransomware-as-a-service operation active since 2023, adopting a cartel-style affiliate structure. Linked to the Scattered Spider threat group. Tracked internally by Symantec as "Hackledorb." Researchers describe DragonForce's tradecraft in this incident as "exceptionally sophisticated."

Why This Is LotL — The Core Technique

Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft's Skype-backed identity services, then uses a legitimate Microsoft TURN (Traversal Using Relays around NAT) relay server — the same infrastructure Teams uses to route messages when a direct connection is unavailable — to establish a connection, before running a QUIC session to the real attacker C2 server. To network defenders, the only visible traffic is outbound connections to legitimate Microsoft Teams servers. This is the first documented real-world implementation of a technique previously only theorized in Praetorian's "Ghost Calls" research (Black Hat 2025).

Intrusion Timeline & Target

The intrusion began in December 2025 against a major U.S. services company and persisted for up to two months before deployment of the ransomware payload. The vulnerable Huawei driver used in the BYOVD chain (HWAuidoOs2Ec.sys / "Havoc Process Terminator") was independently documented as vulnerable by Huntress in March 2026 — after this attack had already occurred.

Additional Defense Evasion — BYOVD

Alongside Backdoor.Turn, the attackers used ABYSSWORKER, a custom malicious driver specifically designed to masquerade as a legitimate Palo Alto Networks driver, plus exploitation of the vulnerable Huawei audio driver for a "Bring Your Own Vulnerable Driver" (BYOVD) defense-evasion technique to terminate security processes.

Backdoor.Turn Capabilities

Command execution, process creation, network scanning, TLS certificate collection, LDAP and Active Directory enumeration, browser credential theft, and credential-based lateral movement. The backdoor was injected into the legitimate DbgView64.exe process after the ransomware payload was deployed — researchers assess this was likely intended for long-term persistence or to be resold to other cybercriminal groups, given the unusual decision to leave sophisticated custom tooling behind after encryption.

Full Attack Chain

Initial access → reconnaissance and defense evasion (BYOVD via ABYSSWORKER + Huawei driver) → credential theft and AD enumeration → lateral movement → data exfiltration → DragonForce ransomware deployment → Backdoor.Turn injected into DbgView64.exe post-encryption for potential follow-on access.

IOCs — Published by Symantec · June 16, 2026

🔴 Malware family: Backdoor.Turn (custom Go-based RAT)

🔴 Defense-evasion driver: ABYSSWORKER (masquerades as legitimate Palo Alto Networks driver)

🔴 BYOVD vulnerable driver: HWAuidoOs2Ec.sys (Huawei) — "Havoc Process Terminator" exploitation technique

🔴 Process injection target: DbgView64.exe (legitimate Sysinternals tool used as host process)

🔴 Protocol signature: Anonymous Teams visitor token request via Skype-backed identity services → TURN relay setup → QUIC session to real C2

Symantec has published a complete IOC list in their full research report — refer to the Symantec Threat Hunter Team publication for hashes and network indicators before deploying blocking rules.

▶ Defensive Actions

1. Network monitoring teams: Be aware that outbound traffic to legitimate Microsoft Teams/TURN relay endpoints is no longer a reliable "safe" signal in isolation. Behavioral and volumetric anomaly detection on Teams-related traffic (unusual connection patterns, timing, or volume from a single host) is now warranted given this confirmed technique.
2. EDR/process monitoring: Treat unexpected child processes or unusual network activity originating from DbgView64.exe or other legitimate Sysinternals-style tools with elevated suspicion — this is a known injection target in this campaign.
3. Driver allow-listing: Verify driver signing enforcement is active and review loaded driver inventories for anything claiming to be Palo Alto Networks software that wasn't deployed by your own security team — ABYSSWORKER specifically impersonates this vendor.
4. Patch management: Confirm the Huawei HWAuidoOs2Ec.sys driver vulnerability (documented by Huntress, March 2026) is remediated or the driver is blocked via your EDR's vulnerable-driver blocklist.
5. If you suspect compromise: Given the two-month dwell time observed in this case, any suspected DragonForce activity warrants a full retrospective hunt across AD logs, LDAP query history, and browser credential store access — not just a point-in-time scan.
6. Obtain and apply Symantec's full IOC list for hash- and network-based detection rules.

MITRE ATT&CK TTPs

T1090.003 (Proxy: Multi-hop Proxy — TURN relay abuse) · T1572 (Protocol Tunneling — QUIC over Teams infrastructure) · T1014 (Rootkit / BYOVD — ABYSSWORKER) · T1068 (Exploitation for Privilege Escalation — Huawei driver) · T1003 (OS Credential Dumping — browser credential theft) · T1018 (Remote System Discovery — AD/LDAP enumeration) · T1486 (Data Encrypted for Impact — DragonForce ransomware)

References: BleepingComputer — June 16, 2026 · Help Net Security — June 16, 2026 · Infosecurity Magazine · SC Media · Symantec — Original Research

Technique ID	Technique Name	Tactic	Observed In
T1090.003	Proxy — Multi-hop Proxy	Command and Control	Microsoft Teams TURN relay abuse for C2 routing
T1572	Protocol Tunneling	Command and Control	QUIC session tunneled through Teams relay to real C2
T1014	Rootkit / BYOVD	Defense Evasion	ABYSSWORKER driver masquerading as Palo Alto Networks software
T1068	Exploitation for Privilege Escalation	Privilege Escalation	Vulnerable Huawei HWAuidoOs2Ec.sys driver exploitation
T1003	OS Credential Dumping	Credential Access	Browser credential theft via Backdoor.Turn
T1018	Remote System Discovery	Discovery	LDAP and Active Directory enumeration
T1486	Data Encrypted for Impact	Impact	DragonForce ransomware payload deployment

Campaign	Category	Actor	Platform	Sector	Impact	IOCs	First Reported	Priority Action
DragonForce / Backdoor.Turn — Microsoft Teams TURN Relay C2 Abuse	🔧 LotL💀 Ransomware	DragonForce (RaaS, linked to Scattered Spider)	Microsoft Teams TURN relay infrastructure	Services / any org using Microsoft Teams — broad applicability	Critical	✓ Full IOC set — Symantec	2026-06-16 (Symantec / multiple corroborating outlets)	Review Teams traffic anomalies · audit loaded drivers · hunt for DbgView64.exe injection

🔬 RESEARCH Steam Workshop Abused to Distribute Malware via Wallpaper Engine "Application Wallpapers" — Backdoors, Infostealers, and Crypto Miners Disguised as Desktop Customization Downloads — Kaspersky Research

Kaspersky researchers disclosed an ongoing campaign abusing Steam Workshop — Valve's built-in content-sharing platform — to distribute malware disguised as Wallpaper Engine wallpapers. Wallpaper Engine supports "application wallpapers," a category that are effectively standalone executable Windows applications running as animated desktop backgrounds — a legitimate feature that attackers have weaponized since at least late 2025. Infected packages can hijack Steam accounts, install backdoors, deploy infostealers, or run cryptomining processes. The campaign primarily targets gamers in China and Russia (89% of observed targets), with additional victims in Singapore, Hong Kong, Germany, Vietnam, India, and Canada.

Why this matters for your environment: While this campaign targets consumer gaming activity, it is directly relevant to organizations with BYOD policies or employees who use personal/work-shared devices for both gaming and corporate access. Wallpaper Engine has nearly one million reviews and roughly 100,000 daily active users — a credential or session compromised through a malicious wallpaper on a shared device can become a foothold into corporate resources if that device also has work credentials cached or VPN access configured.

BleepingComputer / Kaspersky / SC Media · June 16, 2026 · → Read more — BleepingComputer

Trusted Collaboration Platforms Are Becoming Native C2 Infrastructure

The DragonForce/Backdoor.Turn disclosure marks a meaningful escalation in a trend DeepFalcon has tracked across recent reports: attackers increasingly treat enterprise collaboration platforms not as targets, but as infrastructure. Where earlier 2026 reporting documented threat actors abusing Microsoft Teams for social-engineering-based initial access (impersonating IT support over Teams calls), this incident demonstrates abuse of Teams' underlying network relay protocol itself for command-and-control — a fundamentally different and more concerning category. The technique was first theorized publicly less than a year ago at Black Hat 2025; DragonForce is the first confirmed group to operationalize it against a real victim.

The practical defensive challenge this creates is significant: organizations cannot simply block Teams TURN relay traffic without breaking legitimate Teams functionality for remote and hybrid workers behind restrictive NATs. This pushes the detection burden toward behavioral analysis — volume, timing, and destination-pattern anomalies in otherwise-legitimate-looking traffic — rather than simple allow/block rules. Expect this technique to be replicated against other collaboration platforms with similar relay architectures (Zoom, Slack Huddles, Google Meet) as the underlying NAT-traversal protocols are broadly similar across vendors.