DragonForce intrusion — first ITW Microsoft Teams TURN-relay C2 (Backdoor.Turn) + four-driver BYOVD chain
campaign · item:dragonforce-backdoor-turn-teams-relay-byovd
Coverage timeline
1
first 2026-06-17 → last 2026-06-17
Briefs
1
1 distinct
Sources cited
15
9 hosts
Sections touched
1
deep_dive
Co-occurring entities
0
no co-occurrence
Story timeline
- 2026-06-17CTI Daily Brief — 2026-06-17
Where this entity is cited
- deep_dive1
Source distribution
- attack.mitre.org4 (27%)
- nvd.nist.gov3 (20%)
- helpnetsecurity.com2 (13%)
- bleepingcomputer.com1 (7%)
- horizon3.ai1 (7%)
- joomlacontenteditor.net1 (7%)
- security.com1 (7%)
- securityboulevard.com1 (7%)
- other1 (7%)
All cited sources (15)
- security.comprimaryinlineSymantec / Broadcom, 2026-06-16https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor
- attack.mitre.orginline`T1190` Exploit Public-Facing Applicationhttps://attack.mitre.org/techniques/T1190/
- attack.mitre.orginline`T1574.002`https://attack.mitre.org/techniques/T1574/002/
- attack.mitre.orginline`T1136.001`https://attack.mitre.org/techniques/T1136/001/
- attack.mitre.orginline`T1090` Proxyhttps://attack.mitre.org/techniques/T1090/
- bleepingcomputer.cominlineBleepingComputer, 2026-06-16https://www.bleepingcomputer.com/news/security/ransomware-gang-abuses-microsoft-teams-relays-to-hide-malicious-traffic/
- helpnetsecurity.cominlineHelp Net Security, 2025-05-06https://www.helpnetsecurity.com/2025/05/06/exploited-vulnerability-software-managing-samsung-digital-displays-cve-2024-7399/
- helpnetsecurity.cominlineHelp Net Security, 2026-06-16https://www.helpnetsecurity.com/2026/06/16/dragonforce-microsoft-teams-malware-backdoor-turn/
- horizon3.aiinlineHorizon3.ai — SimpleHelp RMM disclosureshttps://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/
- joomlacontenteditor.netinlineWidget Factory / JCE, 2026-06-03https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites
- nvd.nist.govinlineNVD CVE-2024-57726https://nvd.nist.gov/vuln/detail/CVE-2024-57726
- nvd.nist.govinlineNVD CVE-2024-57728https://nvd.nist.gov/vuln/detail/CVE-2024-57728
- nvd.nist.govinlineNVD CVE-2024-7399https://nvd.nist.gov/vuln/detail/CVE-2024-7399
- securityboulevard.cominlineSecurity Boulevard, 2026-04-24https://securityboulevard.com/2026/04/cisa-warns-of-multiple-simplehelp-vulnerabilities-exploited-in-attacks/
- windowsforum.cominlineWindowsForum, 2026-04-24https://windowsforum.com/threads/cisa-adds-4-kev-flaws-patch-samsung-magicinfo-simplehelp-d-link-dragonforce-ransomware-april-2026/
Items in briefs about DragonForce intrusion — first ITW Microsoft Teams TURN-relay C2 (Backdoor.Turn) + four-driver BYOVD chain
No parsed item heading or body matches this entity yet. Items match by exact CVE id (for CVE entities), by lead-segment substring of the title in the item heading or body, or by a distinctive anchor token from the title appearing in the item heading. Coverage that lives inside a broader section (no per-item heading) is captured by the Story timeline above.