[dragonforce]

October 3, 2026

• DragonForce backdoors hide C2 inside relay protocols. Lab52 details two implants from a recent intrusion: an in-memory Go implant (Shell.dll) that abuses legitimate Microsoft Teams TURN servers so traffic resembles ordinary WebRTC relay sessions, carrying SSH over that path; and a persistent second stage launched from a scheduled task via DLL sideloading of legitimate javaw.exe → jli.dll → a DPAPI-encrypted rvsdiqw.txt payload, with MQTT as fallback C2 when TURN fails (Lab52). · Threat Activity & Malware

in NetScaler Round Two: Patched Appliances Crashing Again as a New SAML Bug Gets Reproduced

September 27, 2026

• Storm-2570 keeps the same tradecraft across four ransomware brands. Microsoft has tracked the affiliate since April 2025 deploying Qilin, DragonForce, Anubis and BERT with largely uniform post-compromise tooling, infrastructure overlaps, and repeated use of the same remote access and cloud exfiltration tooling — the argument being that payload-centric tracking hides the actor doing the intrusions (Microsoft). · Cloud & Identity

in Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week

July 11, 2026

• Qilin continues to lead the 2026 ransomware landscape by volume (708 tracked attacks), ahead of The Gentlemen, Akira, INC, and DragonForce. DarkFeed via Ido Cohen · Threat Intelligence

in Progress Orders ShareFile Storage Controllers Offline Over Active Zero-Day Threat

June 20, 2026

• DragonForce affiliates deployed a custom Go RAT, Backdoor.Turn, that hides C2 inside legitimate Microsoft Teams relay infrastructure, observed by Symantec/Carbon Black against a major U.S. services firm. The Hacker News, SecurityWeek · Ransomware & Extortion

in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token

June 19, 2026

• DragonForce ransomware affiliates deployed a custom Go RAT (Backdoor.Turn) that hides C2 traffic inside legitimate Microsoft Teams relay infrastructure, evading network detection during lateral movement and exfiltration at a major US services firm, per Symantec/Carbon Black (The Hacker News, The Register). · Threat Activity & Intrusions

in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk

June 17, 2026

• DragonForce ransomware deployed a custom Go backdoor (Backdoor.Turn) that hides C2 traffic inside legitimate Microsoft Teams relay infrastructure to evade network detection. SecurityWeek, BleepingComputer. · Threat Activity

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists