1.
Overview Article Title: Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams Source: Unit 42 Published Date: 2026-08-31 Original Source: Unit 42 Related Sources: None Related Malware, Threat Groups, CVEs, Products: Spring Ring, PowerShell RAT, Microsoft Teams, Microsoft Quick Assist, Microsoft Edge, Active Directory Severity: High
2.
Executive Summary Spring Ring uses external Teams accounts to impersonate corporate IT staff.
It uses voice calls to trick targets into running RMM tools or custom malware.
In advanced cases, the campaign attempts NTLM Relay against domain controllers using PetitPotam.
3.
Attack Flow From External Teams Chat to Attempted Domain Privilege Escalation The attacker sets up an external tenant and a display name to impersonate the IT department.
The attacker sends a one-on-one Teams chat to the target, followed immediately by a voice call to build trust and urgency.
In Campaign A, the attacker tricks the target into running an RMM tool like Quick Assist to enumerate devices and the domain.
The attacker downloads an obfuscated PowerShell RAT, attempts to bypass AMSI, and connects to the C2 server.
In Campaign B, the attacker delivers an executable file via an S3 URL tailored to the target, establishing persistence, a hidden Edge instance, and extensions.
The attacker uses Python to scan internal TCP/445 and triggers NTLM authentication toward the domain controller.
The attacker forces authentication using PetitPotam and attempts to gain domain privileges via NTLM Relay, though this was blocked in observed cases.
4.
Attacker Positioning and Execution Location External attackers connecting to Teams from a Microsoft 365 external tenant.
After running RMM or malware, the attacker reaches the internal network and Active Directory from the user device.
5.
Victim and Administrator Visibility Victim Receives a chat and voice call on Teams from a display name that looks like internal IT staff, followed by a request for remote support or update tasks.
Administrator Indicators include chats and immediate calls from external tenants, unusual RMM usage, PowerShell, customized S3 URLs, hidden Edge instances, and SMB/EFSRPC traffic.
6.
Success and Failure Conditions Success Conditions The attacker can start Teams chats and calls from an external tenant to the target.
The target believes the attacker is IT staff and launches the RMM tool or executable file.
Communication from the endpoint to C2, SMB, and domain controllers is allowed.
Preconditions for NTLM Relay, such as authentication, signing, and certificate service configurations, remain in place.
Failure Conditions / Risk Mitigation Restrict external Teams communication to business needs and verify external callers through a separate channel.
Require approval for Quick Assist and third-party RMM tools to block unauthorized RMM use by standard users.
Enable PowerShell controls, AMSI, application control, and EDR.
Strengthen Relay defenses, such as SMB signing, NTLM restrictions, and Extended Protection for Authentication.
7.
What Happens Upon Success Remote device control and information gathering via RMM or RAT.
Persistence, browser extension sideloading, and internal server discovery.
Domain privilege escalation and lateral movement if NTLM Relay succeeds.
8.
Observable Logs Email: The primary vector is Teams; email logs alone cannot confirm initial contact.
Proxy/SWG/DNS: Connections to , S3 URLs containing target names, and unknown file distribution points.
Endpoint/EDR: or unauthorized RMM, obfuscated PowerShell, AMSI bypass, executables in directories, hidden Edge instances, and sideloaded extensions.
Identity/IdP: Chats and calls from external tenants, with the same external ID contacting multiple users in a short time.
SaaS/Cloud: Audit logs for Teams chat creation, call initiation, external participants, call duration, and shared URLs.
Network: TCP/445 scans from non-standard processes, NTLM traffic, EFSRPC, and forced authenticati