Backdoor.Turn C2 server — malware establishes direct QUIC session to this IP after relay-assisted setup via Microsoft Teams TURN infrastructure
