Microsoft issues statement debunking Teams ransomware rumours

Rumours also claimed ransomware was being installed via the BlueKeep exploit

Ransomware splash screen mockup

Microsoft’s Security Response Centre (MSRC) has issued a statement to its customers who had started to believe the rumours circulating online that Dopplepaymer ransomware is spreading through Microsoft Teams and the Bluekeep exploit.

The Dopplepaymer ransomware has been infecting businesses primarily in Spain recently and according to Microsoft, merely the fact that many of these businesses run Microsoft Teams is just coincidental.

Advertisement - Article continues below

Microsoft said its security researchers have “found no evidence” to support the claims that the ransomware is circulating through the Microsoft Teams client and installing via the BlueKeep exploit.

"In our investigations, we found that the malware relies on remote human operators using existing Domain Admin credentials to spread across an enterprise network," said Simon Pope, director of incident response at MSRC. 

"Protection from Dopplepaymer and other malware is already available for customers using Windows Defender, and we will continue to enhance these protections as we identify new emerging threats."

Cyber security expert Kevin Beaumont Tweeted his agreement with the MSRC team upon hearing about the rumours.

"Just to reiterate this again, the only attacks I’ve seen in the wild with Bluekeep are lame cryptocurrency things spread via Metasploit,” said Beaumont, who recently discovered the first-ever BlueKeep exploit in the wild. “None of the recent ransomware incidents have involved Bluekeep.”

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"Also, the Microsoft Teams update thing is being repeated by security companies is sourced from a single tweet speculating about it," he added. "It's not a thing, it was never a thing, it's not a vector in ransomware. The unsexy truth is attackers get domain admin."

In addition to debunking the rumours, Microsoft said that ransomware is still one of the most profitable attack methods for cyber criminals to exploit and, as such, IT admins must take proper care when maintaining cyber hygiene.

"These best practices can help prevent Dopplepaymer operators and other attackers from disabling security tools and using privileged credentials to destroy or steal data or hold it for ransom," said Pope.

Microsoft Teams is a collaboration client used by millions of businesses worldwide and it hit the 20 million daily user milestone this week.

The news sent rival Slack’s share price tumbling 10%, another hit to the free-to-use client which it overtook earlier this year.

Teams is part of the paid-for Office 365 suite of products or as a free version too. It’s currently the second most widely-used workplace collaboration platform behind Microsoft-owned Skype for Business which will eventually be replaced by Teams, the company has confirmed.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/29204/how-can-you-protect-your-business-from-crypto-ransomware
Security

How can you protect your business from crypto-ransomware?

4 Nov 2019
Visit/software/355486/zoom-review-are-we-alone-now
video conferencing

Zoom review: Are we alone now?

29 Apr 2020

Most Popular

Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020