Backdoor.Turn – CyberSecurityBoard

Malware

TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks

Cybersecurity researchers have uncovered a new Python-based implant framework called TWINLOOT that abuses trusted Microsoft services for command-and-control (C2) operations. The malware,…

Backdoor.Turn Broadcom C2 infrastructure Carbon Black

August 18, 2026

Attack Groups

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

Threat actors associated with the DragonForce ransomware group have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to…

ABYSSWORKER Backdoor.Turn Broadcom BYOVD

June 25, 2026

Malware

Backdoor.Turn: Go-Based RAT Abusing Microsoft Teams TURN

Backdoor.Turn is a Go-based remote access trojan used by DragonForce ransomware to hide C2 traffic inside Microsoft Teams relay infrastructure via QUIC…

Backdoor.Turn DragonForce Go Microsoft Teams

June 25, 2026

Cyber Companies

Symantec: Documented Backdoor.Turn

Symantec, owned by Broadcom, documented the Backdoor.Turn RAT used by DragonForce ransomware to abuse Microsoft Teams TURN relays.

Backdoor.Turn DragonForce Symantec

June 25, 2026

Cyber Companies

Carbon Black: Co-Documented Backdoor.Turn

Carbon Black, alongside Symantec, detailed the Backdoor.Turn RAT's use of TURN relays for C2 communication.

Backdoor.Turn Carbon Black TURN

June 25, 2026