Cybercriminals mask malicious communications through Microsoft Teams relays

Multiple notable security developments: Symantec reports the DragonForce ransomware group used a custom backdoor (Backdoor.Turn) to tunnel command-and-control traffic through Microsoft Teams TURN relays to evade detection. A critical authentication-bypass in SimpleHelp RMM (CVE-2026-48558) allows unauthenticated actors to create Technician accounts and gain full access to managed endpoints. Cisco disclosed an actively exploited Catalyst SD‑WAN Manager vulnerability (CVE-2026-20262). Other coverage highlights rising AI-driven attack capabilities and vendor responses (new proactive/agent- and ML