Home › Threat Actors › DragonForce (Hackledorb)
← All Threat Actors
Cybercrime high Malaysia (original hacktivist origins) / Eastern Europe (criminal expansion)

DragonForce (Hackledorb)

Cybercrime — ransomware operator and RaaS provider (Symantec: Hackledorb) · Financial — ransomware, extortion, and RaaS infrastructure provision

Reports 1
Active Since 2023
Last Reported 22 Jun 2026
Sectors Targeted finance, communications

Tactics, Techniques & Procedures (TTPs)

  • Backdoor.Turn: custom Go-based RAT tunnelling C2 through Microsoft Teams TURN relay using anonymous visitor tokens from Skype services
  • QUIC protocol covert sessions via Teams relay — all traffic appears as legitimate Teams meeting data, defeating DPI and network monitoring trusting Microsoft infrastructure
  • Microsoft SQL Server exploitation for initial access (unpatched internet-facing MSSQL instances)
  • BYOVD (Bring Your Own Vulnerable Driver): four documented techniques to terminate EDR processes before deploying Backdoor.Turn
  • Extended dwell time: 1-2 months of stealthy persistence before ransomware deployment documented
  • Active Directory enumeration, browser credential extraction, network scanning via 36 built-in Backdoor.Turn commands (including LDAP queries and TLS certificate capture)
  • RaaS infrastructure provision to other ransomware groups in addition to direct operations

Known Targets

Major US services firms (finance and professional services)UK retail sector organisationsEuropean manufacturing and logisticsEnterprise environments running Microsoft Teams and internet-facing MSSQL globally

Analyst Notes

DragonForce originated as a Malaysian hacktivist collective before evolving into a ransomware criminal operation (Hackledorb, active from June 2023). Backdoor.Turn's C2 channel — Microsoft's own Teams TURN relay infrastructure — is the first documented weaponisation of this technique. All traffic appears as legitimate Teams session data; organisations whose security tooling trusts Microsoft network traffic are blind to this C2 channel. DragonForce also provides RaaS infrastructure to other groups, meaning DragonForce-origin code may be deployed by affiliates rather than the core team directly, complicating attribution.

Also Known As

Hackledorb (Symantec designation)DragonForce Malaysia (hacktivist predecessor)

MITRE ATT&CK Techniques

T1572 Protocol Tunneling (Teams TURN relay C2) T1190 Exploit Public-Facing Application (MSSQL) T1562.001 Impair Defenses: Disable or Modify Tools (BYOVD EDR kill) T1486 Data Encrypted for Impact T1059 Command and Scripting Interpreter

Intelligence Reports

Briefing financecommunications

DragonForce Hides C2 in Microsoft Teams: Backdoor.Turn Evades Detection for Two Months

DragonForce ransomware operators deployed a custom Go-based backdoor that tunnels command-and-control traffic through legitimate Microsoft Teams relay infrastructure, rendering traditional network monitoring ineffective.

22 Jun 2026 · 4 min read