The Dragonforce ransomware group has executed a sophisticated intrusion against Aptora, a major U.S.-based civil engineering firm, by employing a "Living off Trusted Services" (LOTS) technique. The attackers deployed 'Backdoor.Turn', a custom Go-based Remote Access Trojan (RAT), which utilizes the Microsoft Teams relay infrastructure for Command-and-Control (C2). By routing malicious traffic through legitimate Microsoft SaaS endpoints, the group successfully masked C2 communications as standard HTTPS/TLS telemetry and messaging. This method allows the threat actor to bypass traditional network security monitoring and EDR solutions, facilitating long-term persistence and increasing the risk of large-scale data exfiltration and subsequent ransomware deployment.

• Incident Overview: Aptora Intrusion

  • Target: Aptora, a prominent U.S. civil engineering and services firm.
  • Primary Risk: Potential exfiltration of sensitive intellectual property, including civil engineering designs and client data.
  • Operational Impact: High risk of service disruption through subsequent ransomware deployment and data encryption.

• Attack Mechanics: LOTS and Backdoor.Turn

  • Malware Payload: Deployment of 'Backdoor.Turn', a bespoke Remote Access Trojan (RAT) written in the Go programming language.
  • C2 Methodology: Exploitation of Microsoft Teams API and relay infrastructure to facilitate communication.
  • Evasion Strategy: Routing traffic through legitimate Microsoft SaaS endpoints to blend with standard enterprise communications.
  • Protocol Masking: Encapsulation of malicious commands within HTTPS/TLS packets, mimicking legitimate Teams telemetry and messaging.

• Threat Profile: Dragonforce Tactics

  • Actor Sophistication: Advanced use of "Living off Trusted Services" (LOTS) to circumvent perimeter-based security.
  • Sector Vulnerability: High alert for critical infrastructure and engineering firms utilizing the Microsoft 365 ecosystem.
  • Persistence Strategy: Maintaining long-term presence by masking malicious activity within high-reputation cloud traffic.

• Defensive Actions: Detection and Mitigation

  • Network Monitoring: Identification of anomalous API calls to Microsoft Teams endpoints originating from non-standard processes.
  • Endpoint Detection: Hunting for unusual Go-compiled binary execution patterns and suspicious outbound TLS connections.
  • Traffic Analysis: Inspection of outbound traffic to Microsoft infrastructure for deviations from typical user and telemetry behavior.

• Conclusion: Emerging Evasion Trends

  • Strategic Shift: Demonstrates an increasing trend of leveraging high-reputation SaaS platforms to bypass EDR and NTA.
  • Defensive Requirement: Necessity for enhanced visibility into application-layer communications within trusted cloud environments.