Executive Summary
DragonForce, a Ransomware-as-a-Service (RaaS) group, has evolved into a sophisticated "ransomware cartel" employing advanced persistence and C2 techniques. Recent analysis by Lab52 reveals the group is abusing legitimate Traversal Using Relays around NAT (TURN) servers, specifically those belonging to Microsoft Teams, to mask malicious traffic. The operation utilizes two distinct backdoors: an in-memory Go-based implant (Shell.dll) for initial deployment and a secondary DLL-sideloading implant for long-term persistence.
The group's secondary backdoor is notable for its redundancy, implementing MQTT as a fallback communication channel if TURN-based encapsulation fails. The persistence mechanism involves DLL sideloading via javaw.exe and relies on DPAPI-encrypted payloads to bind the malware to specific victim machines. By blending into legitimate communication protocols and using encrypted in-memory segments during periods of inactivity, DragonForce significantly complicates detection for standard EDR and network monitoring solutions.