Ransomware groups identified as STAC5143 and STAC5777 have exploited Microsoft Office 365’s services and default settings to target enterprise users, according to an investigation by Sophos researchers. Microsoft Teams’ built-in remote control capabilities and default setting, which allows external users to contact internal users, were used to execute attacks. To prevent further attacks, organizations have been advised to restrict Teams calls from outside organizations and limit the use of remote access applications.
What is memory forensics?
Once used to recover encrypted data, memory forensics is now a core tool in the fight against rootkits
