Microsoft Teams Relay Abused to Stealthily Route Malware Communications

A sophisticated ransomware campaign has turned Microsoft’s own collaboration infrastructure against defenders, with attackers concealing command-and-control traffic inside Microsoft Teams’ relay servers, marking the first known exploitation of TURN relay technology for malware communications in the wild. Symantec Team, who investigated and attributed the intrusion, noted that initial access was likely gained through a vulnerability in an SQL or MSSQL server,…

Diamond Model