Microsoft disrupts ransomware attacks targeting Teams users

Microsoft disrupted a wave of attacks by the financially motivated group Vanilla Tempest (also tracked as VICE SPIDER/Vice Society) that used malvertising and SEO-poisoned search ads to push fake Microsoft Teams installers (MSTeamsSetup.exe) from lookalike domains; the installers were signed with trusted certificates and deployed the Oyster backdoor to enable remote access, data theft, and the deployment of Rhysida ransomware. Microsoft revoked over 200 malicious certificates after discovering the campaign, which has targeted sectors including education, healthcare, IT, and manufacturing and has used code-signing services from multiple providers.