DragonForce Uses Teams Relays To Hide

The DragonForce threat group has developed a sophisticated technique to abuse Microsoft Teams relay infrastructure as a covert communication channel for their backdoor operations. By tunneling command and control (C2) traffic through legitimate Teams relay servers, attackers effectively hide malicious communications within trusted Microsoft infrastructure, bypassing traditional security controls and making detection significantly more challenging. This technique leverages the inherent trust organizations place in Microsoft’s cloud services, creating a dangerous blind spot in network security monitoring.

Introduction

In a concerning evolution of adversary tradecraft, the DragonForce hacking group has begun exploiting Microsoft Teams infrastructure to conceal backdoor command and control traffic. This technique represents a growing trend where threat actors abuse legitimate cloud services and trusted platforms to evade detection by security solutions that typically whitelist traffic to and from well-known corporate applications.

The abuse of Teams relay servers is particularly insidious because it allows attackers to blend malicious traffic with the enormous volume of legitimate Microsoft 365 communications that flow through corporate networks daily. For organizations that have adopted Teams as their primary collaboration platform, distinguishing between legitimate user activity and attacker C2 becomes exceptionally difficult without sophisticated behavioral analysis capabilities.

This development underscores the challenges security teams face when protecting hybrid cloud environments where the line between trusted and untrusted traffic continues to blur.

Background & Context

DragonForce is an emerging threat actor that has demonstrated increasing sophistication in its operational security and evasion techniques. The group has targeted organizations across multiple sectors, with a particular focus on entities with valuable intellectual property and sensitive data.

Microsoft Teams operates through a complex relay infrastructure designed to facilitate real-time communications across global networks. These relays handle media traffic, messaging, and other collaboration features, processing millions of connections from legitimate enterprise users daily. The relay servers use standard HTTPS protocols and connect to Microsoft-owned IP ranges that are typically whitelisted by enterprise security controls.

The technique of abusing legitimate cloud services for C2 communications—often called “living off the trusted land”—has gained popularity among advanced threat actors. Previous campaigns have leveraged services like Google Drive, Dropbox, and Slack for similar purposes. However, the abuse of Teams relay infrastructure represents a particularly effective approach given Teams’ deep integration into the Microsoft 365 ecosystem and its prevalence in enterprise environments.

Technical Breakdown

The DragonForce Teams relay abuse technique operates through several technical stages:

Initial Compromise and Backdoor Deployment

The attack begins with initial access through phishing, credential theft, or exploitation of perimeter vulnerabilities. Once inside the network, DragonForce operators deploy a custom backdoor that includes Teams relay communication capabilities.

Teams Relay Registration Process

The backdoor establishes connectivity by mimicking legitimate Teams client behavior:

POST /v1/users/ME/endpoints HTTP/1.1
Host: teams.microsoft.com
Authorization: Bearer [STOLEN_OR_GENERATED_TOKEN]
Content-Type: application/json

{
  "endpointId": "[UNIQUE_IDENTIFIER]",
  "capabilities": ["messaging", "media"],
  "transport": "relay"
}

This registration process allows the backdoor to obtain relay server addresses and authentication tokens necessary for establishing covert channels.

C2 Communication Flow

Once registered, the malware communicates with attacker infrastructure through the following flow:

• Backdoor → Teams Relay: Encrypted C2 traffic sent to legitimate Microsoft relay servers
• Teams Relay → Attacker Server: Relayed traffic forwarded to attacker-controlled Teams accounts or webhook endpoints
• Response Path: Commands return through the same relay infrastructure in reverse

The actual C2 traffic is encapsulated within protocol structures that mimic Teams media or messaging traffic:

# Simplified representation of C2 payload structure
c2_payload = {
    "messageType": "media_chunk",
    "timestamp": current_timestamp(),
    "sessionId": legitimate_looking_guid(),
    "data": base64_encode(encrypt(command_data))
}

Traffic Obfuscation Techniques

DragonForce implements multiple layers of obfuscation:

• Protocol Mimicry: Traffic patterns match legitimate Teams telemetry and keepalive messages
• Timing Jitter: Random delays between communications mimic human interaction patterns
• Volume Blending: C2 traffic volume stays within normal ranges for Teams clients
• Encryption Layering: Standard Teams encryption plus additional custom encryption layers

Impact & Risk Assessment

Severity Level: High

The Teams relay abuse technique presents significant risks across multiple dimensions:

Detection Evasion Impact

Traditional network security controls face severe limitations:

• DLP and Proxy Bypass: Teams traffic typically receives trusted status and reduced inspection
• Signature Evasion: Traffic appears identical to legitimate Microsoft communications at network level
• Allow-list Exploitation: Security policies designed to enable collaboration inadvertently enable attacker communications

Operational Security Risks

Organizations face extended dwell times as attackers maintain persistent access:

• Reconnaissance activities remain undetected for extended periods
• Data exfiltration can proceed slowly within normal traffic patterns
• Lateral movement planning occurs with reduced risk of triggering alerts

Blast Radius

Any organization using Microsoft Teams is potentially vulnerable, representing hundreds of millions of users globally. The technique requires no zero-day exploits, relying instead on design characteristics of legitimate infrastructure.

Business Impact

Compromised organizations may experience:

• Extended breach discovery timelines (90+ days average)
• Significant data loss before detection
• Regulatory compliance violations
• Reputational damage when breaches are disclosed

Vendor Response

Microsoft has been notified of the Teams relay abuse technique. While the company has not issued specific security advisories regarding DragonForce’s methodology, Microsoft’s position on such abuse typically centers on several key points:

Official Guidance

Microsoft emphasizes that Teams operates as designed and that the relay infrastructure functions according to specifications. The company advocates for:

• Implementation of conditional access policies
• Enforcement of multi-factor authentication
• Deployment of Microsoft Defender for Endpoint for behavioral detection
• Utilization of Microsoft Sentinel for advanced threat hunting

Platform Updates

Microsoft continuously updates Teams security features, including:

• Enhanced audit logging for relay connection patterns
• Improved anomaly detection in Teams traffic analytics
• Integration with Microsoft 365 Defender threat intelligence

Organizations should ensure they are running the latest versions of Teams clients and have enabled all available security logging features within the Microsoft 365 compliance center.

Mitigations & Workarounds

Short-term Tactical Mitigations

Enhance Authentication Controls:

# Enforce conditional access for Teams
Set-CsTeamsClientConfiguration -Identity Global 
  -AllowGuestUser $false 
  -AllowEmailIntoChannel $false 
  -RestrictedSenderList "external-domains.com"

Network Segmentation:
Implement micro-segmentation to limit lateral movement even if C2 communication succeeds.

Endpoint Hardening:
Deploy application control policies to prevent unauthorized processes from network communication:

# AppLocker example for limiting process network access
New-AppLockerPolicy -RuleType Publisher 
  -Path "C:\Program Files\Microsoft Teams\*" 
  -User Everyone -Action Allow

Long-term Strategic Defenses

Zero Trust Architecture:
Implement comprehensive zero trust principles that verify all communications regardless of source:

• Continuous authentication and authorization
• Micro-perimeter enforcement around sensitive data
• Assume breach mentality in security design

Advanced Behavioral Analytics:
Deploy solutions that baseline normal Teams usage and detect anomalous patterns:

• Unusual connection timing patterns
• Abnormal data volume in Teams traffic
• Process anomalies on endpoints running Teams

Network Traffic Analysis:
While challenging, deep packet inspection of Teams traffic can reveal anomalies:

• Statistical analysis of packet timing
• Volume pattern analysis over extended periods
• Certificate and encryption handshake analysis

Detection & Monitoring

Endpoint Indicators

Monitor for suspicious process behaviors on endpoints:

# Hunt for unexpected processes accessing Teams directories
Get-Process | Where-Object {
  $_.Modules.FileName -like "Teams" -and 
  $_.ProcessName -notlike "Teams"
} | Select-Object ProcessName, Id, Path

Key Indicators:

• Non-Teams processes loading Teams libraries
• Teams-related network activity from unexpected processes
• Unusual CPU or memory consumption from Teams processes
• Registry modifications in Teams configuration keys

Network Detection Strategies

Baseline Analysis:
Establish baselines for normal Teams traffic patterns:

• Average session duration and frequency
• Typical data volume per user
• Standard connection times (aligned with business hours)
• Expected relay server destinations

Anomaly Detection:

# SIEM correlation rule example
rule: teams_relay_abuse_detection
description: Detect potential Teams relay abuse
conditions:
  - destination: teams.microsoft.com relay servers
  - AND connection_duration: > 24 hours
  - AND data_volume: > 95th percentile baseline
  - AND connection_time: outside_business_hours
  - AND source_process: != known_good_teams_processes
action: alert
severity: high

Log Analysis Priorities

Focus logging and analysis on:

Microsoft 365 Audit Logs:

• Teams relay connection events
• Unusual token generation or usage
• New endpoint registrations
• Configuration changes to Teams settings

Endpoint Telemetry:

• Process creation and network connection correlation
• DLL injection or module loading anomalies
• Filesystem access patterns around Teams directories

Network Flow Data:

• Long-duration connections to Teams relay infrastructure
• Statistical outliers in connection patterns
• Unusual geographic diversity in relay server connections

Best Practices

Comprehensive Defense Strategy

Identity and Access Management:

• Enforce MFA Universally: Require multi-factor authentication for all accounts with no exceptions
• Conditional Access Policies: Restrict Teams access based on device compliance, location, and risk signals
• Privileged Access Management: Limit administrative rights and implement just-in-time elevation
• Regular Access Reviews: Audit Teams access permissions and external collaboration settings monthly

Network Security Hardening:

• Implement TLS Inspection: Where possible, decrypt and inspect Teams traffic for anomalies
• Deploy Next-Gen Firewalls: Use application-aware controls with behavioral analysis
• Network Segmentation: Isolate user workstations from sensitive data repositories
• DNS Monitoring: Track DNS queries for unusual Teams-related domains

Endpoint Protection:

# Enable advanced Windows Defender features
Set-MpPreference -EnableNetworkProtection Enabled
Set-MpPreference -EnableControlledFolderAccess Enabled
Set-MpPreference -CloudBlockLevel High

Security Operations:

• Threat Hunting Programs: Proactively search for Teams abuse indicators
• Incident Response Readiness: Develop playbooks specifically for cloud service abuse scenarios
• Security Awareness Training: Educate users about collaboration tool security risks
• Regular Penetration Testing: Include cloud service abuse techniques in red team exercises

Microsoft 365 Specific Configurations

Enable maximum security logging:

# Enable comprehensive Teams audit logging
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
New-RetentionPolicy -Name "TeamsSecurityAudit" 
  -RetentionDays 365 
  -TeamsChannelMessage $true 
  -TeamsChat $true

Key Takeaways

• Trust is a Vulnerability: Implicit trust in Microsoft cloud services creates exploitable blind spots that sophisticated threat actors actively target.
• Detection Requires Depth: Identifying Teams relay abuse demands behavioral analytics and baseline understanding rather than signature-based detection.
• Defense in Depth is Critical: No single control will prevent this technique; layered security across identity, network, endpoint, and data is essential.
• Visibility Gaps are Dangerous: Organizations must invest in logging and monitoring capabilities that extend into cloud collaboration platforms.
• Assume Breach Mentality: Design security architectures assuming that attackers may already be communicating through trusted channels.
• Continuous Adaptation Required: As threat actors evolve techniques to abuse legitimate services, security programs must continuously update detection and response capabilities.
• Collaboration with Vendors: Organizations should actively engage with Microsoft and security vendors to improve detection capabilities for these abuse patterns.

The DragonForce Teams relay technique represents the evolving sophistication of modern threat actors who understand that the most effective hiding places are often in plain sight within trusted infrastructure. Security teams must evolve their detection strategies to account for this reality, moving beyond perimeter-focused controls toward comprehensive behavioral analytics that can identify malicious activity regardless of the communication channel employed.

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/