Microsoft issues statement debunking Teams ransomware rumours

Rumours also claimed ransomware was being installed via the BlueKeep exploit

Microsoft’s Security Response Centre (MSRC) has issued a statement to its customers who had started to believe the rumours circulating online that Dopplepaymer ransomware is spreading through Microsoft Teams and the Bluekeep exploit.

The Dopplepaymer ransomware has been infecting businesses primarily in Spain recently and according to Microsoft, merely the fact that many of these businesses run Microsoft Teams is just coincidental.

Microsoft said its security researchers have “found no evidence” to support the claims that the ransomware is circulating through the Microsoft Teams client and installing via the BlueKeep exploit.

"In our investigations, we found that the malware relies on remote human operators using existing Domain Admin credentials to spread across an enterprise network," said Simon Pope, director of incident response at MSRC. 

"Protection from Dopplepaymer and other malware is already available for customers using Windows Defender, and we will continue to enhance these protections as we identify new emerging threats."

Cyber security expert Kevin Beaumont Tweeted his agreement with the MSRC team upon hearing about the rumours.

"Just to reiterate this again, the only attacks I’ve seen in the wild with Bluekeep are lame cryptocurrency things spread via Metasploit,” said Beaumont, who recently discovered the first-ever BlueKeep exploit in the wild. “None of the recent ransomware incidents have involved Bluekeep.”

"Also, the Microsoft Teams update thing is being repeated by security companies is sourced from a single tweet speculating about it," he added. "It's not a thing, it was never a thing, it's not a vector in ransomware. The unsexy truth is attackers get domain admin."

In addition to debunking the rumours, Microsoft said that ransomware is still one of the most profitable attack methods for cyber criminals to exploit and, as such, IT admins must take proper care when maintaining cyber hygiene.

"These best practices can help prevent Dopplepaymer operators and other attackers from disabling security tools and using privileged credentials to destroy or steal data or hold it for ransom," said Pope.

Microsoft Teams is a collaboration client used by millions of businesses worldwide and it hit the 20 million daily user milestone this week.

The news sent rival Slack’s share price tumbling 10%, another hit to the free-to-use client which it overtook earlier this year.

Teams is part of the paid-for Office 365 suite of products or as a free version too. It’s currently the second most widely-used workplace collaboration platform behind Microsoft-owned Skype for Business which will eventually be replaced by Teams, the company has confirmed.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021
US and Israel join forces to fight ransomware
ransomware

US and Israel join forces to fight ransomware

15 Nov 2021
Almost 70% of CISOs expect a ransomware attack
ransomware

Almost 70% of CISOs expect a ransomware attack

19 Oct 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
Jack Dorsey resigns as Twitter CEO
business management

Jack Dorsey resigns as Twitter CEO

29 Nov 2021
Nike to take customers into the metaverse with 'NIKELAND'
virtualisation

Nike to take customers into the metaverse with 'NIKELAND'

19 Nov 2021