Living Off Trusted Infrastructure: How Attackers Abuse Legitimate Services for C2

DragonForce tunneling ransomware C2 through Microsoft Teams TURN relays is the June 2026 proof that “living off trusted infrastructure” has gone from research concept to fielded attack. When malicious traffic looks like a Teams call, network detection dies.

The New Face of Command-and-Control

In June 2026, Symantec researchers revealed that the DragonForce ransomware group used a custom backdoor named Backdoor.Turn to tunnel command-and-control traffic through Microsoft Teams relay infrastructure — not a proof-of-concept, but a real-world attack against a major U.S. services company.

Living off trusted infrastructure (LOTI) is one of the most dangerous evolutions in modern attacks: rather than standing up their own flaggable infrastructure, threat actors piggyback on services your organization already trusts — Microsoft Teams, GitHub, Slack, Google Drive, even developer IDEs. Defenders see normal traffic from legitimate platforms while attackers exfiltrate data and deploy ransomware underneath.

How Backdoor.Turn Works

The DragonForce attack chain was methodical:

1. Initial access: likely via an unknown SQL/MSSQL server vulnerability
2. Persistence: DLL sideloading through legitimate VirtualBox and DbgView executables
3. Evasion: BYOVD — signed vulnerable drivers from Huawei, Topaz Antifraud, K7 Security, and Tower of Fantasy — to terminate security tools
4. C2 tunneling: Backdoor.Turn obtained anonymous Teams visitor tokens and routed all C2 through Microsoft’s TURN (Traversal Using Relays around NAT) relay servers
5. Data theft: browser credential harvesting, LDAP/AD enumeration, TLS certificate capture, network scanning
6. Deployment: DragonForce ransomware encrypted systems after full reconnaissance

The key innovation is step 4: TURN is the same standard protocol that enables calls when clients sit behind NATs — so all malicious traffic appeared as normal Teams activity to network defenders.

This Isn’t New — But It’s Accelerating

The Ghost Calls Technique (2025)

In 2025, Praetorian demonstrated “Ghost Calls” — hijacking temporary TURN credentials for Teams and Zoom to create stealthy communication tunnels through trusted conferencing infrastructure. It was a proof-of-concept then; DragonForce weaponized it.

LOTL Meets LOTI

LOTL abused built-in tools like PowerShell and WMI. LOTI expands the concept to entire cloud services and SaaS platforms — Teams and Slack for C2 tunneling, GitHub issues/commits/gists as covert exfil channels, Google Drive and OneDrive to blend stolen data with corporate traffic, Discord and Telegram APIs for C2 and distribution, and compromised AWS/Azure accounts to spin up temporary compute.

LOTI-Style Attacks Across 2026

The FortiSandbox case deserves emphasis — three critical flaws in a product whose job is detecting attacks, echoing the GreatXML/RoguePlanet Defender zero-days. The same week’s AUR hijack showed the package-ecosystem version of trusted-infrastructure abuse; see the full AUR analysis. And the AI-infrastructure variant — attackers weaponizing AI services themselves — is covered in Living Off the LLM.

Why LOTI Defeats Traditional Detection

The core problem is trust asymmetry. You pay for and configure these services to be accessible; your firewalls allow Microsoft 365, Google Workspace, and AWS; your SIEM whitelists their domains. Attackers routing through them inherit all that trust:

• Encrypted traffic — Teams/Slack use TLS, blinding DPI without agent-based monitoring
• Shared infrastructure — Microsoft’s TURN servers carry millions of legitimate connections; anomaly detection is needle-in-haystack
• Anonymous access tokens — Teams visitor tokens need no organizational authentication
• Standard protocols — TURN is IETF RFC 6156; blocking it breaks legitimate calls

Defensive Strategies That Still Work

1. Zero trust network architecture — never trust traffic by source, even Microsoft’s servers; microsegment and inspect east-west traffic. Start with zero trust for AI systems principles applied everywhere
2. Identity-centric security — kill anonymous/weakly-authenticated access to collaboration tools; conditional access, continuous authentication, session monitoring. The identity attack patterns are the same ones driving device code phishing
3. SaaS behavioral analytics — CASB or Defender for Cloud Apps baselines; alert on anonymous token generation, unusual relay traffic, anomalous uploads
4. EDR on the endpoint — DLL sideloading and BYOVD produce endpoint indicators network monitoring misses
5. BYOVD blocklists — maintain Microsoft’s Vulnerable Driver Blocklist; alert on driver-load anomalies
6. Agent identity discipline — extend least-privilege to automation: agent identity and least privilege

Actionable Checklist

• Audit anonymous access settings on Teams, Slack, and all collaboration platforms
• Deploy or review CASB/SaaS security monitoring configurations
• Implement zero trust principles for all network segments — no domain whitelisting by reputation
• Patch Fortinet, Cisco, and perimeter devices (FortiSandbox trio, SD-WAN CVE-2026-20245)
• Harden BYOVD protections across the endpoint fleet
• Establish behavioral baselines for collaboration platform usage
• Monitor for unusual TURN/relay traffic patterns
• Validate EDR coverage of sideloading techniques

Frequently Asked Questions

What is LOTI — living off trusted infrastructure?

An attack approach where threat actors abuse legitimate, trusted services — Microsoft Teams, GitHub, Slack, Google Drive, cloud platforms — for command-and-control, exfiltration, and distribution instead of building their own infrastructure. It’s the evolution of living-off-the-land (PowerShell, WMI) scaled to entire SaaS platforms. Because firewalls and SIEMs whitelist these services, malicious traffic inherits their trust.

How does Backdoor.Turn use Microsoft Teams for C2?

DragonForce’s Backdoor.Turn obtains anonymous Microsoft Teams visitor tokens and routes command-and-control traffic through Microsoft’s TURN relay servers — the same NAT-traversal infrastructure that carries legitimate Teams calls. To network defenders, the traffic is indistinguishable from normal Teams activity. Praetorian’s 2025 “Ghost Calls” research previewed the technique.

What is BYOVD and how did DragonForce use it?

Bring Your Own Vulnerable Driver: attackers load legitimately signed drivers with known vulnerabilities — DragonForce used signed drivers from Huawei, Topaz Antifraud, K7 Security, and Tower of Fantasy — then exploit them to terminate security tools with kernel privileges. Countermeasures: Microsoft’s Vulnerable Driver Blocklist and driver-load anomaly monitoring.

How do you detect attacks over trusted infrastructure?

Shift detection from network-level to identity and behavior-level: EDR for DLL sideloading and driver-load anomalies, CASB/SaaS behavioral analytics for anonymous token generation and unusual relay traffic, conditional access policies that eliminate anonymous sessions, and zero trust segmentation that inspects east-west traffic regardless of destination reputation.

References

• Symantec — DragonForce Backdoor.Turn research, June 2026
• Praetorian — Ghost Calls TURN hijacking research, 2025
• Microsoft — Vulnerable Driver Blocklist; IETF RFC 6156 (TURN)
• Hmmnm — Living Off the LLM: Attackers Weaponize AI Infrastructure
• Hmmnm — Zero Trust Architecture for AI Systems
• Hmmnm — GreatXML to RoguePlanet: Security Tools as Targets
• Hmmnm — Over 400 AUR Packages Hijacked
• Hmmnm — Device Code Phishing 2026