Skip to content
Auto-CTI
Back to all actors

DragonForce

Unknown Active
Mentions
2
First seen
17 Jun 2026
Last seen
18 Jun 2026

Relevant to you · Relevant

Threat focus:
ransomware

Origin

Unattributed

Profile

DragonForce is a ransomware group that abuses Microsoft Teams relay servers to disguise command-and-control traffic for a backdoor called Backdoor.Turn. This technique allows the group to conduct ransomware attacks while evading detection.

Affected vendors

Microsoft

Associated malware / tools

DragonForce ransomwareBackdoor.Turn

Activity (8 weeks)

22
23
24
25
26
27
28
29

Recent activity

ESC