Microsoft Threat Intelligence Podcast Ahoy! A Tale of Payroll Pirates Who Target Universities
In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by security researchers Tori Murphy and Anna Seitz to unpack two financially motivated cyber threats. First, they explore the Payroll Pirates campaign (Storm 2657), which targets university payroll systems through phishing and MFA theft to reroute direct deposits. Then, they examine Vanilla Tempest, a ransomware group abusing fraudulent Microsoft Teams installers and SEO poisoning to deliver the Oyster Backdoor and Recita ransomware.
Together, they discuss how attackers exploit trust in identity, code signing, and SaaS platforms and share practical steps organizations can take to strengthen defenses, from phishing-resistant MFA to stricter executable controls and out-of-band banking verification.
In this episode you’ll learn:
-
How Payroll Pirates diverted university salaries through SaaS HR phishing schemes
-
Why universities are prime targets for identity-based cyberattacks
-
How Vanilla Tempest evolved from basic ransomware to complex multi-stage attacks
Some questions we ask:
-
How are attackers stealing credentials and paychecks?
-
Why do attackers create inbox rules after compromising accounts?
-
What alerts should organizations monitor for these types of attacks?
Resources:
Investigating targeted “payroll pirate” attacks affecting US universities
Related Microsoft Podcasts:
Discover and follow other Microsoft podcasts at microsoft.com/podcasts
Get the latest threat intelligence insights and guidance at Microsoft Security Insider
The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.