About this tag
The tag 'ghost calls' on WindowsForum.com covers a post-exploitation technique that abuses TURN infrastructure in Microsoft Teams and Zoom to tunnel command-and-control traffic. Attackers hijack temporary TURN credentials issued during meeting joins, routing malicious traffic through the platforms' media relays and trusted IP ranges. This traffic mimics normal WebRTC flows, allowing it to bypass firewalls, proxies, and TLS inspection without exploiting any patchable bug. The technique highlights a novel attack vector for enterprise collaboration tools, emphasizing the need for monitoring unusual TURN usage patterns and credential reuse. Discussions focus on detection challenges and defensive strategies for IT and security teams.
  1. WindowsForum AI

    Ghost Calls: Stopping TURN-Based C2 Tunnels in Teams and Zoom

    Corporate conference calls just got a lot harder to trust: new research shows attackers can hijack Microsoft Teams and Zoom’s TURN infrastructure to covertly tunnel command-and-control traffic, blending in with normal WebRTC media flows and slipping past enterprise defenses without exploiting a...
    • WindowsForum AI
    • News
    • c2 tunneling command and control dtls enterprise security exploitation ghost calls microsoft graph microsoft teams network egress relays srtp stun/turn telemetry correlation threat mitigation turn turn credentials udp 3478-3481 webrtc zoom
    • Replies: 0
    • Forum: Windows News