"Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick Assist, and PetitPotam for NTLM Relay
"Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick (TL-2026-2276), also tracked as Spring Ring, is a high-severity phishing campaign, first published 2026-09-01. It has no confirmed attribution, affects Microsoft Microsoft Teams, maps to 17 MITRE ATT&CK techniques (T1036, T1046, T1053), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-2276
- Threat ID
- TL-2026-2276
- Also known as
- Spring Ring
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-09-01
- Last reviewed
- 2026-09-01
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- multiple-industries
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick
Malware and tooling: PetitPotam, Quick Assist
Unit 42 (Palo Alto Networks) documented a vishing campaign dubbed 'Spring Ring' running January-April 2026, in which 26+ attacker-controlled Microsoft Teams identities posed as IT support to socially engineer 150+ employees across 10+ companies into granting remote access via Quick Assist/RMM tools or executing malicious files, leading to AMSI/Defender bypass and PetitPotam-based NTLM relay attempts against domain controllers.
How "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick works
Between January and April 2026, Unit 42 tracked a coordinated voice-phishing (vishing) operation it named 'Spring Ring,' published August 31, 2026 (with Help Net Security, Cyberpress, and other outlets carrying follow-on coverage September 1, 2026). Attackers registered external Microsoft Teams tenants (onmicrosoft.com) with names engineered to impersonate internal IT departments. Unit 42 identified at least 8 generic role-based malicious identities — helpcenter@ithelpcenter365.onmicrosoft.com, helpdesk@itprotectiondepartment.onmicrosoft.com, helpdesk@newsystemmaintenance.onmicrosoft.com, helpdesk@officedesk365.onmicrosoft.com, helpdesk@officesecures.onmicrosoft.com, itadmin@mandatorynetworkmonitoring.onmicrosoft.com, internal@internalusahelpdeskit.onmicrosoft.com, and ithelp@internalsystemsdaily.onmicrosoft.com — plus 17+ additional persona-based identities using personalized (rather than generic help-desk) display names, for a total of 26 distinct attacker identities. Operators initiated unsolicited Teams chats with employees and rapidly escalated to voice calls; unsuccessful attempts lasted seconds to a missed call, while successful engagements typically ran 10-15 minutes, and Unit 42 observed attackers cycling through 5-6 identities within minutes when a target didn't answer, targeting the chat-to-call transition speed as a key behavioral signal.
In the 'remote access' path (Campaign A), the caller talked the victim into launching Quick Assist (QuickAssist.exe) or a third-party RMM tool and granting control of the machine. Once in control, the attacker ran discovery commands (`whoami /groups`, `net group /dom`) to enumerate group membership and domain context, then delivered a heavily obfuscated PowerShell loader (retrieved via `Invoke-WebRequest`) — described by Unit 42 as using variable-manipulation and arithmetic obfuscation plus anti-analysis 'bloat' meant to time out deobfuscation tooling. The script disabled AMSI by forcing the `amsiInitFailed` flag and verified the bypass with a test scan, then encrypted host data and beaconed to the attacker domain `san-sid.com` with a 'tiny, nine-line' C2 stager to pull down further payloads (SHA256 `24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b`, fetched from `https://san-sid.com/owners`). Unit 42 reports this campaign was blocked by automated Cortex XDR Agent protections during the malware's execution phase.
In the 'malicious file' path (Campaign B), victims instead received a cloud-storage link — Unit 42 observed AWS S3 objects with URLs templated as `<company_name>-org-filters-update-<victim_name>.s3.us-west-2.amazonaws.com`, with the delivered executable named identically after the target company and the victim's own username. Running it moved the binary to `%TEMP%` and spawned renamed persistence copies (`vhlp-*.exe`, `scnr-*.exe`). The payload launched a hidden/headless Microsoft Edge instance with a sideloaded browser extension (browser hijacking) and a bundled Python component (observed at path `C:\ProgramData\IntegrityData\python.exe`) that performed internal SMB reconnaissance (TCP/445 port scanning) before invoking PetitPotam to coerce the domain controller into authenticating to an attacker-controlled listener — an NTLM-relay attempt aimed at escalating to domain-level privileges. Community technical write-ups estimate roughly 30 minutes elapsed from the initial Teams chat to the SMB scan/EFSRPC coercion attempt for a given victim. Unit 42 Managed Detection and Response blocked the domain-takeover attempt after PetitPotam's DC-coercion step; no report reviewed confirms a successful domain takeover in any observed instance. PetitPotam abuses the MS-EFSRPC `EfsRpcOpenFileRaw` API and is the technique behind the publicly tracked Windows LSA spoofing weakness CVE-2021-36942 (patched/mitigated by Microsoft in August 2021 via Extended Protection for Authentication / certificate-mapping guidance); Unit 42's write-up does not cite a CVE for the Spring Ring campaign itself since the underlying exposure is a systemic NTLM-relay/coercion design issue rather than a single unpatched flaw, and organizations that have not applied the 2021-era mitigations (EPA, SMB signing, disabling NTLM where feasible) remain relayable regardless of patch level.
Unit 42 published 16 attacker-side VPN/proxy IP addresses used for infrastructure, plus dozens of fraudulent onmicrosoft.com Teams-tenant identities. The report references 'Cloaked Ursa' (associated with APT29/Midnight Blizzard) as having previously run Teams-based credential-harvesting campaigns, explicitly as prior-art context for the collaboration-platform vector rather than as attribution — no specific threat-actor name, nation-state attribution, motivation, or CVE was assigned to Spring Ring itself. Help Net Security's coverage additionally notes that phishing alerts tied to collaboration platforms (Teams, Slack, etc.) rose to 42% of all phishing alerts in the first four months of 2026, up from roughly 30% in the preceding four-month period (approximately September-December 2025) — framing Spring Ring as part of a broader shift toward collaboration-platform vishing. Both Unit 42 and secondary analysis recommend correlating Teams audit logs, endpoint telemetry, authentication events, and network flow data within a single behavioral window (chat → call → RMM/PowerShell → cloud download → SMB scan → EFSRPC/NTLM) to reconstruct and detect the full attack chain, since no single log source captures it end to end.
MITRE ATT&CK techniques used in TL-2026-2276
Defense Evasion
Discovery
T1046 Network Service Discovery; T1069.002 Domain Groups
Persistence
T1053 Scheduled Task/Job; T1176 Software Extensions
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
Credential Access
T1187 Forced Authentication; T1557.001 Name Resolution Poisoning and SMB Relay
Lateral Movement
T1550 Use Alternate Authentication Material
Initial Access
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Resource Development
T1583.006 Web Services; T1585 Establish Accounts
defense-impairment
Affected products and versions in "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick
- Microsoft — Microsoft Teams
Vulnerable versions: Default external/federated tenant chat configuration - Microsoft — Windows Server Active Directory Domain Controllers
Vulnerable versions: Domain controllers without Extended Protection for Authentication / SMB signing / NTLM-relay mitigations applied - Microsoft — Quick Assist
Vulnerable versions: Any version used without organizational access restrictions (abused as a legitimate remote-access tool, not a software flaw)
Remediation for "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick
Immediate actions
- Block the known Spring Ring attacker VPN/proxy IPs and the san-sid.com C2 domain at perimeter DNS/URL filtering and firewall egress controls
- Restrict or disable inbound external Microsoft Teams chat requests from unverified onmicrosoft.com tenants, particularly those using IT/helpdesk-themed naming
- Restrict Quick Assist and third-party RMM tool usage to approved IT staff and known support workflows; alert on RMM tool launches (e.g. QuickAssist.exe) by non-IT users
- Hunt for the reported SHA256 (24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b), for spawned processes matching vhlp-*.exe / scnr-*.exe, and for python.exe running from C:\ProgramData\IntegrityData\ across the environment
Workarounds
- Monitor and alert on unsolicited external Teams communications and unknown/unexpected cloud-storage (e.g. S3) download URLs
- Monitor internal SMB scanning (port 445) and unexpected forced-authentication/NTLM-relay traffic toward domain controllers
Longer-term hardening
- Deploy identity-based/behavioral analytics on Teams tenant metadata to flag rapid chat-to-voice-call transitions, cycling through multiple external identities in a short window, and suspicious external tenant naming patterns
- Enforce PetitPotam/NTLM-relay mitigations on all domain controllers: Extended Protection for Authentication (EPA), SMB signing, disabling NTLM where feasible, and blocking unauthenticated MS-EFSRPC/MS-RPRN coercion calls
- Deploy EDR behavioral detections for AMSI-bypass patterns (amsiInitFailed manipulation), hidden/headless browser instances with sideloaded extensions, and scheduled-task-based persistence of renamed binaries
- Build a ~30-minute cross-source correlation rule linking external Teams chat -> voice call -> RMM/PowerShell launch -> cloud-storage (S3) download -> internal SMB(445) scan -> EFSRPC/NTLM authentication for the same user, per Unit 42 and community analysis of the Spring Ring attack-chain timing
- Run recurring user-awareness training specific to collaboration-platform vishing (Teams/Slack impersonation of IT support), given the reported rise in collaboration-platform phishing alerts from ~30% to 42% of all phishing alerts
Timeline of "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick
- Rapid7 publishes technical analysis of the PetitPotam attack chain (MS-EFSRPC coercion), the NTLM-relay technique later reused in the Spring Ring campaign's Campaign B path.
- Microsoft addresses CVE-2021-36942 (Windows LSA Spoofing), the underlying weakness abused by the PetitPotam coercion technique later used in the Spring Ring campaign's NTLM-relay path.
- End of the prior four-month baseline period (roughly September-December 2025) in which collaboration-platform (Teams/Slack) phishing alerts represented approximately 30% of all phishing alerts, the baseline against which the Spring Ring-era Q1 2026 share (42%) is compared.
- Spring Ring vishing campaign activity begins; Unit 42 observes attacker-controlled Microsoft Teams identities initiating unsolicited IT-support chats (approximate start of the January-April 2026 observation window).
- Observed Spring Ring campaign activity concludes at the end of the January-April 2026 window tracked by Unit 42, having reached 150+ employees across 10+ companies via 26+ distinct attacker Teams identities.
- Unit 42 (Palo Alto Networks) publishes 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams,' detailing the campaign's TTPs, the full list of attacker Teams identities and VPN/proxy IPs, and confirmation that Cortex XDR/MDR blocked both the PowerShell RAT execution and the PetitPotam domain-takeover attempt in observed cases.
- Help Net Security, Cyberpress, and dev.to publish coverage summarizing Unit 42's Spring Ring findings, including the rise of collaboration-platform phishing alerts to 42% of all phishing alerts in the first four months of 2026.
Sources cited for "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick
- "Spring Ring" vishing campaign impersonates IT support over Microsoft Teams
- Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
- Spring Ring: From Microsoft Teams Voice Phishing to RMM, RAT, and NTLM Relay
- Microsoft Teams Vishing Campaign Targets 150+ Employees With RMM Abuse
- Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams (mirror)
- PetitPotam Attack Chain Can Compromise Windows Domains Running AD CS
- CVE-2021-36942: Windows LSA Spoofing Vulnerability
More in phishing
- Large-Scale Azure-Hosted Tech Support Scam Campaign Targets Japan (13.38M Emails, 240K+ Relay IPs, 33K+ Disposable Azure Blob Storage Sites)
- Phishing Campaign Impersonates ChatGPT Subscription Billing Alerts to Steal OpenAI Credentials via Google API Open-Redirect and nxcli.io Infrastructure
- Global Fake Parcel Delivery Phishing/Smishing Campaign Steals Card and Bank Details
- Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow
- Revolut Phishing SMS Campaign Follows Social-Engineering Data Breach Exposing 680 Customers' KYC Data
Detection coverage for TL-2026-2276
As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2276 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.