← threat actors
threat actor · MY
DragonForce
also tracked as akira 1, inc 1, qilin 1, the gentlemen 1
5 stories · 4 in the wild · June 17, 2026 – October 3, 2026
evidence: 4 observed
malware and tools
- backdoor turn 3 · Jun 20
- mqtt implant 1 · Oct 3
- shell dll 1 · Oct 3
techniques
- command and control 2 · Oct 3
- dll sideloading 1 · Oct 3
- persistence 1 · Oct 3
- defense evasion 1 · Jun 19
- exfiltration 1 · Jun 19
- lateral movement 1 · Jun 19
attack phases seen
- Command and control 3 · Oct 3
- Persistence 1 · Oct 3
- Exfiltration 1 · Jun 19
- Lateral movement 1 · Jun 19
what we reported, newest first, grouped by story
October 3, 2026
- DragonForce backdoors hide C2 inside relay protocols. Lab52 details two implants from a recent intrusion: an in-memory Go implant (
Shell.dll) that abuses legitimate Microsoft Teams TURN servers so traffic resembles ordinary WebRTC relay sessions, carrying SSH over that path; and a persistent second stage launched from a scheduled task via DLL sideloading of legitimate javaw.exe → jli.dll → a DPAPI-encrypted rvsdiqw.txt payload, with MQTT as fallback C2 when TURN fails (Lab52).
· Oct 3 · observed · Threat Activity & Malware
Jun 17 – July 11, 2026
- Qilin continues to lead the 2026 ransomware landscape by volume (708 tracked attacks), ahead of The Gentlemen, Akira, INC, and DragonForce. DarkFeed via Ido Cohen
· Jul 11 · none · as qilin, the gentlemen, akira, inc · Threat Intelligence
Jun 17 – June 20, 2026 · 3 reports
- DragonForce affiliates deployed a custom Go RAT, Backdoor.Turn, that hides C2 inside legitimate Microsoft Teams relay infrastructure, observed by Symantec/Carbon Black against a major U.S. services firm. The Hacker News, SecurityWeek
· Jun 20 · observed · Ransomware & Extortion
- DragonForce ransomware affiliates deployed a custom Go RAT (Backdoor.Turn) that hides C2 traffic inside legitimate Microsoft Teams relay infrastructure, evading network detection during lateral movement and exfiltration at a major US services firm, per Symantec/Carbon Black (The Hacker News, The Register).
· Jun 19 · observed · Threat Activity & Intrusions
- DragonForce ransomware deployed a custom Go backdoor (Backdoor.Turn) that hides C2 traffic inside legitimate Microsoft Teams relay infrastructure to evade network detection. SecurityWeek, BleepingComputer.
· Jun 17 · observed · Threat Activity