> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
- URL: https://f4n6.co.uk/security-feed/spring-ring-an-inside-look-at-voice-phishing-campaigns-in-microsoft-teams/
- Published: 2026-08-31T20:24:52.000Z
- Updated: 2026-08-31T20:24:52.000Z
- Author: Jeff Davies
- Tags: #security-feed, Spring Ring

## 1\. Executive summary

Unit 42 has disclosed "Spring Ring," a coordinated social-engineering operation active January–April 2026 that used external Microsoft Teams accounts to impersonate IT help desk staff against more than 150 employees across at least 10 companies. Victims were coerced during live voice (vishing) calls into executing remote monitoring and management (RMM) tools or custom malware; a more advanced variant escalated from the vishing call to an NTLM relay attack against the organisation's domain controller. Attribution to any named actor is **unconfirmed** — "Spring Ring" has no MITRE ATT&CK profile in our verified reference data, and the name is a Unit 42 campaign label, not a confirmed actor identity. No CVEs are involved: this is a human-operated, no-exploit attack chain that weaponises Teams' external-chat capability and employee trust in SaaS platforms. The bottom-line risk for EMEA financial services is initial access leading to domain-controller compromise via NTLM relay — a path that terminates in ransomware in comparable Teams-vishing campaigns (Chaos ransomware, EtherRAT) reported by Sophos and BleepingComputer, though those are related-but-distinct operations, not Spring Ring itself.

## 2\. Regulatory framing

| Article                                                                         | Trigger (the fact in this item)                                                                                                                                                                                                                                | Practical impact                                                                                                                                                                                            |
| ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 18: classification of ICT-related incidents and cyber threats         | The item is a **cyber threat** (a social-engineering campaign targeting financial entities' collaboration platform), not merely an incident — DORA's classification duty covers threat classification, which drives whether downstream reporting duties engage | Clients who detect Spring Ring-style contact must classify the event under their Art. 18 process before assuming no reporting obligation; a vishing attempt that fails is still a classifiable cyber threat |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | The attack chain's end state is **domain-controller compromise via NTLM relay**, which if realised would be a major ICT incident for a financial entity                                                                                                        | Pre-stage the Art. 19 reporting workflow for DC-level compromise; the vishing-to-NTLM-relay chain gives a defined detection point at which the major-incident clock may start                               |
| NIS2 Art. 21(2)(d): supply chain security measures                              | The attack abuses **external access to Microsoft Teams** ("Chat with Anyone" external-tenant chat) — a SaaS collaboration platform configuration that determines whether third parties can reach employees                                                     | Treat Teams external-chat policy as a supply-chain security measure under Art. 21(2)(d): document, risk-assess and restrict external tenant communication rather than leaving the default open              |

No UK NIS 2018 duty is specifically engaged by a distinctive fact in this item beyond the generic incident-response obligations that apply to any incident.

## 3\. Technical analysis & attack chain

### Confirmed attack chain (Unit 42 telemetry, Jan–Apr 2026)

1. **Initial contact via external Teams accounts.** Adversaries used Microsoft Teams accounts external to the victim organisation to initiate contact, masquerading as IT help desk personnel. Unit 42 attributes the surge in this technique to Teams' default **"Chat with Anyone"** feature, which permits direct chats from users outside the organisation (corroborated by KnowBe4's reporting of a 41% rise in Teams-based attacks between October 2025 and March 2026, and by Unit 42's own telemetry: collaboration-tool phishing alerts rose from 30% to 42% of all Cortex phishing alerts in the first four months of 2026).
2. **Vishing escalation.** What appears as a benign chat is a live voice phishing call. The attacker uses a professional voice on an audio call to build trust and coerce the victim — a channel Unit 42 notes is less monitored, recorded and documented than email or file operations.
3. **Payload delivery — two distinct vectors observed across two campaigns:** \- **Vector A:** Coercion into executing **remote monitoring and management (RMM) tools** — legitimate tooling abused for hands-on-keyboard access. - **Vector B:** Coercion into executing **custom malware**.
4. **Advanced variant — NTLM relay against the domain controller.** In the more advanced campaign, attackers transitioned from the vishing call to a **Microsoft NT LAN Manager (NTLM) relay attack aimed at the organisation's domain controller**. This is the terminal objective: DC compromise.

### Technical specifics that matter to defenders

- **No software exploit, no CVE.** The chain evades detection "without a software exploit" by exploiting trust in SaaS collaboration platforms. Patching posture is irrelevant to the initial access vector; identity and voice-channel controls are the relevant surface.
- **Identity as the attack vector.** Unit 42 frames the operation as "the weaponization of communication platforms as identity becomes a primary attack vector." The external-tenant Teams identity is the phishing lure itself — there is no fake login page or malicious link in the primary chain (contrast with prior Teams campaigns by Cloaked Ursa/APT29, which relied on credential harvesting, malicious links and fake Entra ID tenants).
- **NTLM relay against the DC** is the highest-impact confirmed capability. Any environment where NTLM authentication to the domain controller is possible remains exposed to this terminal stage once an attacker has coerced a user on the network.
- **Observed scope:** 150+ targeted employees, at least 10 companies, various industries, January–April 2026.

**Related-but-distinct campaigns (context, not Spring Ring):** Sophos and BleepingComputer report Teams-vishing operations delivering **Chaos ransomware** against North American organisations (via Teams vishing, custom malware and remote access tools) and **EtherRAT** malware via fake IT-support Teams calls. Cybersecurity Dive reports dozens of US and Canadian firms targeted with financially motivated (not espionage) intent. These corroborate the Teams-vishing TTP pattern but are **separate operations**; do not conflate their payloads or IOCs with Spring Ring. Check Point/Help Net Security separately reports abuse of Microsoft's legitimate authentication system (Microsoft Planner task-assignment phishing, 200+ emails against \~120 organisations, late June–mid July 2026) — again a related trend, not Spring Ring.

**Confidence caveat:** The Spring Ring campaign detail — the 150-employee/10-company scope, the two payload vectors, and the NTLM-relay-to-DC variant — is **single-sourced** (Unit 42's report). No second vendor has independently corroborated the Spring Ring specifics. Verify against your own Teams and identity telemetry before enforcing attribution-based blocks. The broader Teams-vishing trend, by contrast, is multi-source corroborated (Unit 42, Sophos, BleepingComputer, KnowBe4, Cybersecurity Dive).

## 4\. Mitigation & containment

### P1 — within 24 hours

- **Restrict external Teams chat.** Disable or tightly scope the "Chat with Anyone" / external-tenant direct-chat capability in the Teams admin centre so users cannot receive unsolicited chats or calls from outside the organisation. This is the single control that breaks the initial-access vector across the entire campaign.
- **Hunt for the chain, not the payload.** Search Teams/Entra audit logs for: external-tenant chat/call initiation to help-desk-adjacent user identities, January–April 2026 window; any user-executed RMM tool installation following an external Teams voice call; and NTLM authentication anomalies against domain controllers (unusual NTLM relay patterns, authentication from atypical hosts to the DC).
- **Verify help-desk callback procedure.** Instruct staff that any unsolicited Teams contact or call claiming to be IT support must be terminated and verified via an independently known internal number. The vishing stage only works if the victim stays on the call.

### P2 — within 72 hours

- **Reduce NTLM exposure on the domain.** The advanced variant's terminal stage is an NTLM relay against the DC. Audit NTLM usage, enforce SMB signing, and continue any in-progress NTLM phase-out / EPA-for-LDAP hardening so a relayed authentication cannot be weaponised against the DC.
- **Block unauthorised RMM execution.** Application control / EDR policy to prevent execution of RMM binaries (remote monitoring and management tooling) by standard users, and alert on any RMM process launch not tied to an approved IT management workflow.
- **Monitor the voice channel.** Where Teams calling is recorded or logged, ensure external voice calls are captured and reviewable — Unit 42 specifically identifies voice as a monitoring gap.

### P3 — within 7 days

- **User awareness targeted at the vishing pattern.** Train specifically on external-tenant Teams contact impersonating IT/help desk — not generic phishing. The tell is the *external* identity and the *unsolicited voice call*, not a link.
- **Confirm Teams external-access configuration is documented as a risk decision.** If external chat must remain enabled for business reasons, record the compensating controls (callback verification, RMM blocking, NTLM hardening) against that decision.

No vendor patch applies — there is no exploited CVE. Palo Alto Networks states its customers receive coverage through Advanced URL Filtering, Advanced DNS Security, Cortex XDR/XSIAM, Cortex Advanced Email Security, Cortex Cloud Identity Threat Detection, and the Idira product line (ITDR, EPM, PAM, SIA).

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

Unit 42's disclosure names no specific RMM tools, malware families, file names, domains, IPs or hashes for Spring Ring. Do not import IOCs from the Chaos-ransomware or EtherRAT reports as Spring Ring indicators — those are distinct operations.

### Behavioural indicators

| Behaviour                                                                                     | Where to observe                                                                         | Confidence                                                                   |
| --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| External-tenant Teams account initiating chat/call while presenting as IT help desk personnel | Teams admin centre external access logs; Entra ID sign-in and audit logs                 | High (Unit 42, corroborated as a pattern by Sophos/BleepingComputer/KnowBe4) |
| Unsolicited Teams voice call coercing execution of an RMM tool                                | Teams call records; endpoint process telemetry (RMM binary execution by standard user)   | High (Unit 42)                                                               |
| Teams voice call followed by custom malware execution on the victim endpoint                  | EDR process telemetry correlated with Teams call timestamps                              | High (Unit 42)                                                               |
| Vishing call followed by NTLM relay attempt against the domain controller                     | DC security event logs (NTLM authentication anomalies); network authentication telemetry | High (Unit 42)                                                               |

## 6\. Detection

Insufficient indicators to author detection rules.

The sources provide behavioural patterns (external Teams contact, vishing, RMM execution, NTLM relay to DC) but no atomic artefacts — no strings, command lines, file names, mutexes, registry keys or hashes belonging to the Spring Ring tooling. A YARA or Sigma rule built from the campaign name or product names would detect reporting about the threat, not the threat. The behavioural hunting guidance in §4 (P1) is the actionable detection surface.

## 7\. Sources

- Palo Alto Unit 42 — *Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams* — https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ — 2026-08-31
- Palo Alto Unit 42 — *When "Hi, This Is IT" Comes Through Microsoft Teams* — https://unit42.paloaltonetworks.com/microsoft-teams-phishing/ — (related context)
- Sophos — *Chaos in Teams vishing* — https://www.sophos.com/en-gb/blog/chaos-in-teams-vishing — (related, distinct campaign)
- BleepingComputer — *Microsoft Teams vishing attacks lead to Chaos ransomware attacks* — https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/ — (related, distinct campaign)
- BleepingComputer — *Fake IT support calls on Microsoft Teams push EtherRAT malware* — https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/ — (related, distinct campaign)
- Cybersecurity Dive — *Hackers abuse Microsoft Teams in ransomware campaign through fake IT support* — https://www.cybersecuritydive.com/news/hackers-microsoft-teams-ransomware-it-support/826591/ — (related, distinct campaign)
- Help Net Security — *Attackers are using Microsoft's legitimate login system to camouflage phishing attacks* — https://www.helpnetsecurity.com/2026/07/30/microsoft-authentication-system-phishing/ — 2026-07-30 (related trend, distinct campaign)

## 8\. Adverse Trace position

Spring Ring is a **high-impact, no-exploit threat** whose severity rests not on a CVSS score — there is no CVE — but on its terminal objective: domain-controller compromise via NTLM relay, reached through a vishing call that no perimeter control will stop. The attack surface is a configuration decision (Teams external chat) and a human process (help-desk verification), both fully within clients' control, and both cheap to fix relative to the impact. Attribution is unconfirmed — "Spring Ring" carries no MITRE ATT&CK profile and the campaign detail is single-sourced to Unit 42 — so we advise against actor-based blocking and for behaviour-based hunting: external-tenant Teams contact patterns, RMM execution by standard users, and NTLM authentication anomalies against DCs, over the January–April 2026 window and forward. EMEA financial services clients should treat this as a live initial-access technique, not a historical report: the multi-source trend data (collaboration-tool phishing up from 30% to 42% of Cortex alerts; Teams attacks up 41% per KnowBe4) shows the technique is scaling industry-wide. We will monitor for corroborating vendor reporting, Spring Ring IOC disclosure, and any confirmed victimology in the EMEA financial sector, and will reissue this advisory if attribution or indicators are independently confirmed.

---

[Read the original source →](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*