In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by security researchers Tori Murphy and Anna Seitz to unpack two financially motivated cyber threats. First, they explore the Payroll Pirates campaign (Storm 2657), which targets university payroll systems through phishing and MFA theft to reroute direct deposits. Then, they examine Vanilla Tempest, a ransomware group abusing fraudulent Microsoft Teams installers and SEO poisoning to deliver the Oyster Backdoor and Recita ransomware.  

Together, they discuss how attackers exploit trust in identity, code signing, and SaaS platforms and share practical steps organizations can take to strengthen defenses, from phishing-resistant MFA to stricter executable controls and out-of-band banking verification. 

In this episode you’ll learn:      

How Payroll Pirates diverted university salaries through SaaS HR phishing schemes 

Why universities are prime targets for identity-based cyberattacks 

How Vanilla Tempest evolved from basic ransomware to complex multi-stage attacks 

Some questions we ask:     

How are attackers stealing credentials and paychecks? 

Why do attackers create inbox rules after compromising accounts? 

What alerts should organizations monitor for these types of attacks? 

Resources:  

View Tori Murphy on LinkedIn  

View Anna Seitz on LinkedIn 

View Sherrod DeGrippo on LinkedIn  

Investigating targeted “payroll pirate” attacks affecting US universities 

Microsoft Threat Intelligence healthcare ransomware report highlights need for collective industry action 

Related Microsoft Podcasts:                   

Afternoon Cyber Tea with Ann Johnson 

The BlueHat Podcast 

Uncovering Hidden Risks     

Discover and follow other Microsoft podcasts at microsoft.com/podcasts  

Get the latest threat intelligence insights and guidance at Microsoft Security Insider 

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.