TeamViewer abused to breach networks in new ransomware attacks

Ransomware actors are leveraging compromised or weakly secured TeamViewer accounts to access enterprise endpoints and deploy LockBit-3-style encryptors (password-protected DLLs launched via rundll32) using a dropped PP.bat file; Huntress observed multiple attempts with one infection contained and another blocked by antivirus, and analysis ties the samples to variants built from a leaked LockBit 3.0 builder.