DragonForce: the cartel makes a TURN in Ransomware Capabilities

DragonForce: the cartel makes a TURN in Ransomware Capabilities

Speakers: Thibaut Passilly, Threat Hunter, Broadcom

Conference: Area41

YouTube: https://www.youtube.com/watch?v=rBbgMN_JlHU

Overview

In an illuminating presentation at Area41, Thibaut Passilly, a Threat Hunter at Broadcom (Symantec and Carbon Black), delved into the evolving tactics of DragonForce, a rapidly emerging ransomware cartel. This talk, titled "DragonForce: the cartel makes a TURN in Ransomware Capabilities," unveiled the group's sophisticated operational model, advanced tooling, and, most notably, a novel command-and-control (C2) mechanism leveraging legitimate video conferencing infrastructure. The discussion highlighted how DragonForce, despite its relatively recent emergence in 2023, has quickly professionalized its operations, exhibiting a concerning capacity for high-impact attacks and continuous innovation in its evasion techniques.

The significance of this research lies in exposing a ransomware group that not only operates with the scale and efficiency of a cartel but also pioneers stealthy C2 channels that bypass traditional network defenses. DragonForce's ability to compromise large organizations, as evidenced by the Marks & Spencer breach in April 2025, underscores its potent threat. Passilly's analysis, rooted in a late 2025 case study involving a small US-based customer, revealed that even lower-value targets are subjected to highly sophisticated attack chains, suggesting the group's intent to test new tools or to resell access to compromised networks.

The core revelation of the talk centered on DragonForce's deployment of a TURN-based backdoor, a mechanism that abuses the Traversal Using Relays around NAT (TURN) protocol, typically employed by video conferencing applications like Microsoft Teams. This groundbreaking finding represents the first documented instance of malware utilizing this technique in the wild for C2 communications, presenting a formidable challenge to existing network security paradigms. By masquerading malicious traffic within trusted, often whitelisted, video conferencing streams, DragonForce demonstrates a strategic shift towards exploiting legitimate services for nefarious purposes, demanding a re-evaluation of defensive strategies.

Background

▶ Watch: Introduction to DragonForce ransomware cartel and its capabilities (1:15)

The modern ransomware landscape is a dynamic and evolving threat, heavily influenced by the leakage of sophisticated ransomware builders and source codes. Thibaut Passilly traced the lineage of DragonForce back to 2022, a pivotal year marked by the public release of the LockBit Black 3.0 builder and the source code for Conti V3. These leaks provided a fertile ground for new ransomware operations to emerge, leveraging pre-built, robust frameworks. DragonForce quickly capitalized on this, with its first version appearing in 2023, based on LockBit, and a second version in 2024, adopting elements from Conti.

By 2025, DragonForce declared itself a "cartel," a significant operational shift indicating a network of affiliates and shared resources. The group's first publicly identified affiliate was Devman, and subsequent investigations by Broadcom confirmed shared Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) between Devman and DragonForce, validating the cartel model. This structure allows for increased operational scale, specialization, and resilience, making the group a more formidable adversary.

DragonForce's primary motivation is purely financial, with ransom demands ranging from $200,000 to an astonishing $10 million. Their affiliate program offers a lucrative revenue share, with 80% going to affiliates and 20% to the cartel operators, incentivizing widespread attacks. The group employs double extortion, a common but effective tactic where data is exfiltrated prior to encryption, and victims are pressured into paying by the threat of public data leakage. While they primarily target organizations in America and Europe, their victimology is broad, spanning various industries without specific targeting, indicating a focus on maximizing monetary gain rather than strategic objectives. The group's rapid growth, with approximately 400 victims identified from their leak site alone within a year (implying many more who paid), underscores the urgency of understanding their operational capabilities and defensive implications.

Key Findings

▶ Watch: DragonForce's evolution from LockBit/Conti to a cartel (6:00)

The research presented by Thibaut Passilly unveiled several critical findings regarding DragonForce's operations and technical prowess, painting a picture of a highly adaptive and dangerous ransomware cartel.

Firstly, DragonForce exhibits rapid growth and significant impact. Emerging in 2023, the group surged through 2025 and 2026, amassing around 400 publicly identified victims in a single year, with many more likely paying ransoms in secret. Their capacity to compromise large enterprises was dramatically demonstrated by the April 2025 breach of Marks & Spencer, a major European retail company. This attack resulted in an estimated impact of £270 million to £440 million in losses and forced a mandatory password reset for all customers, highlighting DragonForce's ability to inflict substantial financial and reputational damage.

Secondly, the group operates with a high degree of professionalization. This includes maintaining a dedicated leak site to enforce double extortion tactics, offering a user-friendly affiliate panel for easy recruitment, and providing "proof of breach" to pressure victims. This structured approach, combined with a cartel model involving affiliates like Devman, allows DragonForce to scale its operations and distribute its workload effectively.

Thirdly, DragonForce employs an advanced and continuously evolving toolset. A key aspect of their defense evasion strategy is the use of Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security products. The talk highlighted the use of vulnerabilities in legitimate drivers from K7 and Tower of Fantasy, with disclosure dates remarkably close to the attack timeline, indicating rapid toolset updates. Most strikingly, they exploited a Huawei driver vulnerability that was undisclosed at the time of the attack, only being publicly revealed by Huntress in March 2026. This demonstrates DragonForce's access to or development of zero-day exploits, positioning them among the most sophisticated threat actors. Additionally, they utilize a custom-built process killer, the Abyss worker driver, which masquerades as a Palo Alto driver and bypasses Windows driver signature enforcement using stolen or revoked certificates.

Finally, and perhaps most critically, the presentation revealed DragonForce's deployment of a novel TURN-based backdoor for command and control. This C2 mechanism abuses the TURN protocol, typically used by video conferencing services, to establish stealthy communication channels. This is the first documented instance of malware using this technique in the wild, a finding confirmed by ESET. The backdoor, observed in two versions, leverages legitimate protocols like QUIC, DTLS, and SCTP, primarily through Microsoft Teams' infrastructure. It offers a comprehensive suite of capabilities, including command execution, process creation, network scanning, Active Directory (AD) search, credential theft, payload injection, and key logging. The speaker hypothesized that this sophisticated backdoor, even when deployed against small, low-value targets, could be used for testing new tooling or for reselling access to compromised networks, indicating a diversified revenue stream beyond direct ransomware payments.

Technical Deep Dive

▶ Watch: Defense evasion: using 'Bring Your Own Vulnerable Driver' (BYOVD) (11:00)

DragonForce's attack methodology, as detailed in the case study, showcases a blend of common initial access vectors with highly sophisticated post-exploitation techniques, culminating in their unique TURN-based C2.

The infection chain typically begins with initial access gained through a vulnerability in Microsoft SQL or related software. Once inside, the attackers deploy PowerShell to download a zip archive from an attacker-controlled server. This archive is crucial, as it contains legitimate binaries that are then used for DLL sideloading. Malicious DLLs, downloaded from a list of likely compromised WordPress websites, are loaded by these legitimate executables, allowing the attackers to establish a foothold and execute further actions.

Following initial compromise, DragonForce focuses on securing access and reconnaissance. They create new user accounts, modify firewall rules, and leverage the limit blank password use registry setting to enable passwordless RDP connections. This suggests either multiple operators within the group or collaboration with other threat actors, requiring easy shared access. For reconnaissance, they list installed applications and gather operating system version information, tailoring subsequent actions to the specific environment.

The group's defense evasion tactics are particularly advanced, centered on Bring Your Own Vulnerable Driver (BYOVD). This technique involves exploiting vulnerabilities in legitimate, signed drivers to gain kernel-level privileges, most often to terminate security processes. The presentation highlighted several specific drivers:

• K7 and Tower of Fantasy drivers: Vulnerabilities in these drivers were exploited, with their disclosure dates remarkably close to the attack, indicating DragonForce's agility in integrating new exploits.
• Huawei driver: A critical finding was the exploitation of a Huawei driver vulnerability that was not publicly disclosed at the time of the attack, eventually revealed by Huntress in March 2026. This points to DragonForce's access to zero-day exploits or private vulnerability intelligence, elevating their threat profile significantly.
• Abyss worker driver: This is a custom-built driver designed specifically to kill processes. It masquerades as a Palo Alto Networks driver and employs stolen or revoked certificates to bypass Windows' stringent driver signature enforcement, granting it the necessary privileges to disable endpoint security solutions.

The most innovative technical aspect uncovered is the TURN-based backdoor for remote access. To understand this, one must grasp how TURN (Traversal Using Relays around NAT) functions in video conferencing. In modern networks, Network Address Translation (NAT) and firewalls often impede direct peer-to-peer (P2P) communication between participants. TURN relays solve this by providing an intermediary server. Participants request an "allocation" or "room" on the TURN relay, establishing a channel. The relay then forwards data between participants without inspecting the content, prioritizing speed for real-time video and audio frames. This makes the relay "blind" to the actual data being transmitted, facilitating a P2P-like connection even through network obstacles.

DragonForce abuses this blindness. Inspired by Praetorian's "ghost calls" talk at Black Hat USA 2025, which demonstrated using TURN for C2, DragonForce developed its own malicious tunnel. The compromised host requests an allocation on a legitimate TURN relay server, specifically observed to be Microsoft Teams. It then communicates with the attacker's C2 server using standard video conferencing protocols like DTLS (Datagram Transport Layer Security) and SCTP (Stream Control Transmission Protocol) over TURN. These protocols provide encryption and transmission control, making the malicious traffic appear legitimate. Because the TURN relay is blind and often whitelisted by corporate firewalls (Zoom and Microsoft even recommend whitelisting TLS inspection for their subdomains), the C2 traffic flows undetected, effectively hiding the C2 address and bypassing network security controls.

Two versions of this backdoor were observed:

• Version 1 (on the victim's machine): Utilized QUIC (Quick UDP Internet Connections), a protocol developed by Google. QUIC operates over TCP, provides built-in TLS 1.3 encryption, and is multiplexed by design, offering efficiency and stealth.
• Version 2: Replicated QUIC's features but was hand-written, using KCP (a reliable transmission control algorithm) for data integrity (at the cost of more bandwidth) and Smux (a Go library for multiplexing), combined with AES encryption. This bespoke implementation grants DragonForce greater control and potentially enhanced stealth, tailored to their specific needs.

Both backdoor versions share a common set of capabilities, indicating their use as a versatile remote access tool: command execution, process creation, network scanning, Active Directory search, credential theft, payload injection, and key logging. This extensive functionality points towards the backdoor being a comprehensive platform for further exploitation, data exfiltration, or, as hypothesized, for reselling access to other threat actors. The deployment of such sophisticated tooling on a small, low-value business suggests either a testing ground for new capabilities or a strategy to monetize access to any compromised network, regardless of its immediate perceived value.

Demo / Proof of Concept

▶ Watch: First in-the-wild malware using TURN relay (Microsoft Teams) (19:00)

While the talk did not feature a live demonstration or proof-of-concept by the speaker, the presentation detailed a real-world case study of DragonForce's operations against a US-based customer. This case study served as a compelling "proof of concept" from the perspective of an actual attack, illustrating the practical implementation and effectiveness of DragonForce's advanced tooling and the novel TURN-based backdoor. The speaker referenced the work of Praetorian, who presented on "ghost calls" at Black Hat USA 2025, demonstrating the theoretical abuse of TURN relays for C2, which informed the understanding of DragonForce's in-the-wild deployment. The detailed analysis of the infection chain, defense evasion techniques, and the architecture of the TURN backdoor provided a thorough technical breakdown, effectively demonstrating how the threat actor's capabilities functioned in a live environment.

Defensive Implications

▶ Watch: Key takeaways: sophisticated tooling, cartel, testing new capabilities (24:50)

The insights into DragonForce's sophisticated tactics, particularly their use of BYOVD with undisclosed vulnerabilities and the novel TURN-based backdoor, carry profound defensive implications for organizations of all sizes. Traditional security paradigms are increasingly insufficient against such adaptive adversaries.

Firstly, the prevalence of sophisticated tools, even against small businesses, underscores that network-based traffic blocking is no longer sufficient on its own. The TURN backdoor, by tunneling malicious C2 over legitimate, often whitelisted, video conferencing protocols like those used by Microsoft Teams, bypasses many perimeter defenses. Network administrators are even advised to whitelist TLS inspection for these services, inadvertently creating blind spots. Defenders must therefore move beyond simple port and protocol filtering to deep packet inspection and behavioral analytics that can detect anomalous data patterns or non-video traffic traversing legitimate video conferencing channels.

Secondly, the concept that "legitimate services don't mean legitimate usage" must be a cornerstone of modern security. Organizations must adopt a Zero Trust architecture, where no user, device, or application is inherently trusted, regardless of its perceived legitimacy. This requires continuous verification and strict access controls, rather than blanket trust for enterprise applications.

Thirdly, the use of BYOVD with zero-day or rapidly integrated vulnerabilities highlights the critical need for robust patch management and advanced endpoint protection. Regular and timely application of security patches for all software, especially operating systems and drivers, is paramount. However, since DragonForce can exploit undisclosed vulnerabilities, organizations must deploy Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) solutions capable of detecting malicious behavior at the kernel level, such as unauthorized driver loading, process manipulation, and attempts to disable security software. These tools are crucial for identifying BYOVD attempts and custom process killers like the Abyss worker driver.

Fourthly, multi-factor authentication (MFA) remains a fundamental defense against credential theft and unauthorized access. DragonForce's attempts to secure access through new user creation and passwordless RDP connections underscore the importance of MFA for all remote access and administrative interfaces. Even if credentials are stolen, MFA can prevent their immediate misuse.

Finally, organizations must invest in proactive threat hunting and stay abreast of the latest threat intelligence. Understanding emerging TTPs, such as the abuse of TURN relays or specific BYOVD drivers (like the Huawei one), allows defenders to anticipate attacks and implement targeted detection rules. Security teams should monitor for unusual network connections to known TURN servers, especially those not associated with active video conferences, and scrutinize driver activity for suspicious loads or certificate anomalies. The fact that DragonForce might be testing new tooling on smaller targets also implies that even seemingly low-value organizations need robust defenses, as they could be unwitting testbeds for future, larger attacks.

Key Takeaways

• DragonForce is a highly operational and rapidly growing ransomware cartel, leveraging a professionalized structure with affiliates and double extortion tactics, posing a significant and escalating threat.
• The group utilizes advanced and continuously updated tooling, including sophisticated BYOVD techniques that exploit both recently disclosed and previously undisclosed vulnerabilities (e.g., the Huawei driver), demonstrating significant resources and technical prowess.
• DragonForce has pioneered a novel TURN-based backdoor for Command and Control (C2), the first observed in-the-wild, which abuses legitimate video conferencing infrastructure (like Microsoft Teams) to establish stealthy, encrypted communication channels that bypass traditional network defenses.
• Traditional network-centric security measures are insufficient against such stealthy C2 mechanisms; defenders must evolve to implement deep packet inspection, behavioral analytics, and Zero Trust principles to detect anomalous traffic over trusted protocols.
• Multi-layered security, robust patch management, and advanced Endpoint Detection and Response (EDR) capabilities are critical for detecting and mitigating the full spectrum of DragonForce's attack chain, from initial access and DLL sideloading to BYOVD and the TURN backdoor.
• The deployment of highly sophisticated tools on smaller, lower-value targets suggests DragonForce may be testing new capabilities or reselling network access, indicating a diversified and evolving threat model that requires constant vigilance across all organizational tiers.

About the Speaker(s)

Thibaut Passilly is a Threat Hunter based in France, working within the Threat Hunting and Research team at Symantec and Carbon Black, both part of Broadcom. His work focuses on tracking and analyzing ransomware threats and Advanced Persistent Threat (APT) groups. Passilly's expertise lies in understanding end-to-end attack chains to enhance security products and provide actionable threat intelligence to customers through alerts, blog posts, and presentations like this one.