Ahoy! A Tale of Payroll Pirates Who Target Universities

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by security researchers Tori Murphy and Anna Seitz to unpack two financially motivated cyber threats. First, they explore the Payroll Pirates campaign (Storm 2657), which targets university payroll systems through phishing and MFA theft to reroute direct deposits. Then, they examine Vanilla Tempest, a ransomware group abusing fraudulent Microsoft Teams installers and SEO poisoning to deliver the Oyster Backdoor and Recita ransomware. Together, they discuss how attackers exploit trust in identity, code signing, and SaaS platforms and share practical steps organizations can take to strengthen defenses, from phishing-resistant MFA to stricter executable controls and out-of-band banking verification. In this episode you’ll learn: How Payroll Pirates diverted university salaries through SaaS HR phishing schemes Why universities are prime targets for identity-based cyberattacks How Vanilla Tempest evolved from basic ransomware to complex multi-stage attacks Some questions we ask: How are attackers stealing credentials and paychecks? Why do attackers create inbox rules after compromising accounts? What alerts should organizations monitor for these types of attacks? Resources: View Tori Murphy on LinkedIn View Anna Seitz on LinkedIn View Sherrod DeGrippo on LinkedIn Investigating targeted “payroll pirate” attacks affecting US universities Microsoft Threat Intelligence healthcare ransomware report highlights need for collective industry action Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.