Russian Cybercriminals Target UK Computers via Microsoft Teams

A report by UK-based cybersecurity firm Sophos has revealed that Russian cybercriminals are utilizing Microsoft Teams to infiltrate British businesses. The hackers, identified as members of ransomware gangs such as Fin7 and Storm-1811, employ a strategy that involves overwhelming the target with approximately 3,000 spam messages within an hour. They then initiate contact through Teams, posing as tech support to gain remote access to the victim's computer.

The default settings of Microsoft Teams allow external individuals to communicate with internal company staff, which the attackers exploit. Once they gain access, the cybercriminals install malicious software to extract confidential data. Sean Gallagher, Sophos' principal threat researcher, emphasized the concern that many firms employ managed service providers, making it less likely for suspicious calls from unknown individuals to raise alarms.

This exposure of cyber threats comes at a time when the British government is considering a ban on ransomware payments, especially for public sectors like councils and NHS trusts. The move aims to deter cybercriminal activity, which is predominantly linked to Russian or former Soviet operators, who reportedly generated $1.1 billion from ransomware in 2023 alone.

As the frequency and sophistication of hostile cyber activities increase, officials are urging companies to remain vigilant against these emerging threats.