DragonForce Ransomware Abused Microsoft Teams to Hide Malware Activity

The DragonForce ransomware group exploited an unpatched SQL server vulnerability (or leveraged an initial access broker) to gain a foothold, then used Microsoft Teams' relay infrastructure to disguise command-and-control traffic as legitimate business communications — a tactic that renders traditional C2 detection nearly useless. By blending malicious traffic with trusted collaboration tools, attackers bypassed security controls that rely on domain or IP reputation. The use of DLL sideloading and Bring Your Own Vulnerable Driver (BYOVD) techniques further allowed them to neutralize endpoint defenses before deploying ransomware. This attack illustrates how trusted cloud platforms can become blind spots when organizations lack deep traffic inspection and behavioral analytics. Failing to patch internet-facing services and monitor lateral movement enabled a multi-stage compromise that could have been disrupted at several points.