Microsoft issues statement debunking Teams ransomware rumours

Rumours also claimed ransomware was being installed via the BlueKeep exploit

Microsoft’s Security Response Centre (MSRC) has issued a statement to its customers who had started to believe the rumours circulating online that Dopplepaymer ransomware is spreading through Microsoft Teams and the Bluekeep exploit.

The Dopplepaymer ransomware has been infecting businesses primarily in Spain recently and according to Microsoft, merely the fact that many of these businesses run Microsoft Teams is just coincidental.

Microsoft said its security researchers have “found no evidence” to support the claims that the ransomware is circulating through the Microsoft Teams client and installing via the BlueKeep exploit.

"In our investigations, we found that the malware relies on remote human operators using existing Domain Admin credentials to spread across an enterprise network," said Simon Pope, director of incident response at MSRC. 

"Protection from Dopplepaymer and other malware is already available for customers using Windows Defender, and we will continue to enhance these protections as we identify new emerging threats."

Cyber security expert Kevin Beaumont Tweeted his agreement with the MSRC team upon hearing about the rumours.

"Just to reiterate this again, the only attacks I’ve seen in the wild with Bluekeep are lame cryptocurrency things spread via Metasploit,” said Beaumont, who recently discovered the first-ever BlueKeep exploit in the wild. “None of the recent ransomware incidents have involved Bluekeep.”

"Also, the Microsoft Teams update thing is being repeated by security companies is sourced from a single tweet speculating about it," he added. "It's not a thing, it was never a thing, it's not a vector in ransomware. The unsexy truth is attackers get domain admin."

In addition to debunking the rumours, Microsoft said that ransomware is still one of the most profitable attack methods for cyber criminals to exploit and, as such, IT admins must take proper care when maintaining cyber hygiene.

"These best practices can help prevent Dopplepaymer operators and other attackers from disabling security tools and using privileged credentials to destroy or steal data or hold it for ransom," said Pope.

Microsoft Teams is a collaboration client used by millions of businesses worldwide and it hit the 20 million daily user milestone this week.

The news sent rival Slack’s share price tumbling 10%, another hit to the free-to-use client which it overtook earlier this year.

Teams is part of the paid-for Office 365 suite of products or as a free version too. It’s currently the second most widely-used workplace collaboration platform behind Microsoft-owned Skype for Business which will eventually be replaced by Teams, the company has confirmed.

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
New ransomware group is attacking US firms and educational establishments
ransomware

New ransomware group is attacking US firms and educational establishments

15 Jul 2021
Interpol calls for more action to prevent "ransomware pandemic"
cyber security

Interpol calls for more action to prevent "ransomware pandemic"

13 Jul 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Square to acquire Afterpay for $29 billion
mergers and acquisitions

Square to acquire Afterpay for $29 billion

2 Aug 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021