"Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick Assist, and PetitPotam for NTLM Relay

"Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick (TL-2026-2276), also tracked as Spring Ring, is a high-severity phishing campaign, first published 2026-09-01. It has no confirmed attribution, affects Microsoft Microsoft Teams, maps to 17 MITRE ATT&CK techniques (T1036, T1046, T1053), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-2276

Threat ID
TL-2026-2276
Also known as
Spring Ring
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-09-01
Last reviewed
2026-09-01
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
multiple-industries
Detection rules
9
Indicators of compromise
33

Malware and tooling in "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick

Malware and tooling: PetitPotam, Quick Assist

Unit 42 (Palo Alto Networks) documented a vishing campaign dubbed 'Spring Ring' running January-April 2026, in which 26+ attacker-controlled Microsoft Teams identities posed as IT support to socially engineer 150+ employees across 10+ companies into granting remote access via Quick Assist/RMM tools or executing malicious files, leading to AMSI/Defender bypass and PetitPotam-based NTLM relay attempts against domain controllers.

How "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick works

Between January and April 2026, Unit 42 tracked a coordinated voice-phishing (vishing) operation it named 'Spring Ring,' published August 31, 2026 (with Help Net Security, Cyberpress, and other outlets carrying follow-on coverage September 1, 2026). Attackers registered external Microsoft Teams tenants (onmicrosoft.com) with names engineered to impersonate internal IT departments. Unit 42 identified at least 8 generic role-based malicious identities — helpcenter@ithelpcenter365.onmicrosoft.com, helpdesk@itprotectiondepartment.onmicrosoft.com, helpdesk@newsystemmaintenance.onmicrosoft.com, helpdesk@officedesk365.onmicrosoft.com, helpdesk@officesecures.onmicrosoft.com, itadmin@mandatorynetworkmonitoring.onmicrosoft.com, internal@internalusahelpdeskit.onmicrosoft.com, and ithelp@internalsystemsdaily.onmicrosoft.com — plus 17+ additional persona-based identities using personalized (rather than generic help-desk) display names, for a total of 26 distinct attacker identities. Operators initiated unsolicited Teams chats with employees and rapidly escalated to voice calls; unsuccessful attempts lasted seconds to a missed call, while successful engagements typically ran 10-15 minutes, and Unit 42 observed attackers cycling through 5-6 identities within minutes when a target didn't answer, targeting the chat-to-call transition speed as a key behavioral signal.

In the 'remote access' path (Campaign A), the caller talked the victim into launching Quick Assist (QuickAssist.exe) or a third-party RMM tool and granting control of the machine. Once in control, the attacker ran discovery commands (`whoami /groups`, `net group /dom`) to enumerate group membership and domain context, then delivered a heavily obfuscated PowerShell loader (retrieved via `Invoke-WebRequest`) — described by Unit 42 as using variable-manipulation and arithmetic obfuscation plus anti-analysis 'bloat' meant to time out deobfuscation tooling. The script disabled AMSI by forcing the `amsiInitFailed` flag and verified the bypass with a test scan, then encrypted host data and beaconed to the attacker domain `san-sid.com` with a 'tiny, nine-line' C2 stager to pull down further payloads (SHA256 `24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b`, fetched from `https://san-sid.com/owners`). Unit 42 reports this campaign was blocked by automated Cortex XDR Agent protections during the malware's execution phase.

In the 'malicious file' path (Campaign B), victims instead received a cloud-storage link — Unit 42 observed AWS S3 objects with URLs templated as `<company_name>-org-filters-update-<victim_name>.s3.us-west-2.amazonaws.com`, with the delivered executable named identically after the target company and the victim's own username. Running it moved the binary to `%TEMP%` and spawned renamed persistence copies (`vhlp-*.exe`, `scnr-*.exe`). The payload launched a hidden/headless Microsoft Edge instance with a sideloaded browser extension (browser hijacking) and a bundled Python component (observed at path `C:\ProgramData\IntegrityData\python.exe`) that performed internal SMB reconnaissance (TCP/445 port scanning) before invoking PetitPotam to coerce the domain controller into authenticating to an attacker-controlled listener — an NTLM-relay attempt aimed at escalating to domain-level privileges. Community technical write-ups estimate roughly 30 minutes elapsed from the initial Teams chat to the SMB scan/EFSRPC coercion attempt for a given victim. Unit 42 Managed Detection and Response blocked the domain-takeover attempt after PetitPotam's DC-coercion step; no report reviewed confirms a successful domain takeover in any observed instance. PetitPotam abuses the MS-EFSRPC `EfsRpcOpenFileRaw` API and is the technique behind the publicly tracked Windows LSA spoofing weakness CVE-2021-36942 (patched/mitigated by Microsoft in August 2021 via Extended Protection for Authentication / certificate-mapping guidance); Unit 42's write-up does not cite a CVE for the Spring Ring campaign itself since the underlying exposure is a systemic NTLM-relay/coercion design issue rather than a single unpatched flaw, and organizations that have not applied the 2021-era mitigations (EPA, SMB signing, disabling NTLM where feasible) remain relayable regardless of patch level.

Unit 42 published 16 attacker-side VPN/proxy IP addresses used for infrastructure, plus dozens of fraudulent onmicrosoft.com Teams-tenant identities. The report references 'Cloaked Ursa' (associated with APT29/Midnight Blizzard) as having previously run Teams-based credential-harvesting campaigns, explicitly as prior-art context for the collaboration-platform vector rather than as attribution — no specific threat-actor name, nation-state attribution, motivation, or CVE was assigned to Spring Ring itself. Help Net Security's coverage additionally notes that phishing alerts tied to collaboration platforms (Teams, Slack, etc.) rose to 42% of all phishing alerts in the first four months of 2026, up from roughly 30% in the preceding four-month period (approximately September-December 2025) — framing Spring Ring as part of a broader shift toward collaboration-platform vishing. Both Unit 42 and secondary analysis recommend correlating Teams audit logs, endpoint telemetry, authentication events, and network flow data within a single behavioral window (chat → call → RMM/PowerShell → cloud download → SMB scan → EFSRPC/NTLM) to reconstruct and detect the full attack chain, since no single log source captures it end to end.

MITRE ATT&CK techniques used in TL-2026-2276

Defense Evasion

T1036 Masquerading

Discovery

T1046 Network Service Discovery; T1069.002 Domain Groups

Persistence

T1053 Scheduled Task/Job; T1176 Software Extensions

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1219 Remote Access Tools

Credential Access

T1187 Forced Authentication; T1557.001 Name Resolution Poisoning and SMB Relay

Lateral Movement

T1550 Use Alternate Authentication Material

Initial Access

T1566.004 Spearphishing Voice

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Resource Development

T1583.006 Web Services; T1585 Establish Accounts

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick

  • Microsoft — Microsoft Teams
    Vulnerable versions: Default external/federated tenant chat configuration
  • Microsoft — Windows Server Active Directory Domain Controllers
    Vulnerable versions: Domain controllers without Extended Protection for Authentication / SMB signing / NTLM-relay mitigations applied
  • Microsoft — Quick Assist
    Vulnerable versions: Any version used without organizational access restrictions (abused as a legitimate remote-access tool, not a software flaw)

Remediation for "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick

Immediate actions

  • Block the known Spring Ring attacker VPN/proxy IPs and the san-sid.com C2 domain at perimeter DNS/URL filtering and firewall egress controls
  • Restrict or disable inbound external Microsoft Teams chat requests from unverified onmicrosoft.com tenants, particularly those using IT/helpdesk-themed naming
  • Restrict Quick Assist and third-party RMM tool usage to approved IT staff and known support workflows; alert on RMM tool launches (e.g. QuickAssist.exe) by non-IT users
  • Hunt for the reported SHA256 (24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b), for spawned processes matching vhlp-*.exe / scnr-*.exe, and for python.exe running from C:\ProgramData\IntegrityData\ across the environment

Workarounds

  • Monitor and alert on unsolicited external Teams communications and unknown/unexpected cloud-storage (e.g. S3) download URLs
  • Monitor internal SMB scanning (port 445) and unexpected forced-authentication/NTLM-relay traffic toward domain controllers

Longer-term hardening

  • Deploy identity-based/behavioral analytics on Teams tenant metadata to flag rapid chat-to-voice-call transitions, cycling through multiple external identities in a short window, and suspicious external tenant naming patterns
  • Enforce PetitPotam/NTLM-relay mitigations on all domain controllers: Extended Protection for Authentication (EPA), SMB signing, disabling NTLM where feasible, and blocking unauthenticated MS-EFSRPC/MS-RPRN coercion calls
  • Deploy EDR behavioral detections for AMSI-bypass patterns (amsiInitFailed manipulation), hidden/headless browser instances with sideloaded extensions, and scheduled-task-based persistence of renamed binaries
  • Build a ~30-minute cross-source correlation rule linking external Teams chat -> voice call -> RMM/PowerShell launch -> cloud-storage (S3) download -> internal SMB(445) scan -> EFSRPC/NTLM authentication for the same user, per Unit 42 and community analysis of the Spring Ring attack-chain timing
  • Run recurring user-awareness training specific to collaboration-platform vishing (Teams/Slack impersonation of IT support), given the reported rise in collaboration-platform phishing alerts from ~30% to 42% of all phishing alerts

Timeline of "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick

  • Rapid7 publishes technical analysis of the PetitPotam attack chain (MS-EFSRPC coercion), the NTLM-relay technique later reused in the Spring Ring campaign's Campaign B path.
  • Microsoft addresses CVE-2021-36942 (Windows LSA Spoofing), the underlying weakness abused by the PetitPotam coercion technique later used in the Spring Ring campaign's NTLM-relay path.
  • End of the prior four-month baseline period (roughly September-December 2025) in which collaboration-platform (Teams/Slack) phishing alerts represented approximately 30% of all phishing alerts, the baseline against which the Spring Ring-era Q1 2026 share (42%) is compared.
  • Spring Ring vishing campaign activity begins; Unit 42 observes attacker-controlled Microsoft Teams identities initiating unsolicited IT-support chats (approximate start of the January-April 2026 observation window).
  • Observed Spring Ring campaign activity concludes at the end of the January-April 2026 window tracked by Unit 42, having reached 150+ employees across 10+ companies via 26+ distinct attacker Teams identities.
  • Unit 42 (Palo Alto Networks) publishes 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams,' detailing the campaign's TTPs, the full list of attacker Teams identities and VPN/proxy IPs, and confirmation that Cortex XDR/MDR blocked both the PowerShell RAT execution and the PetitPotam domain-takeover attempt in observed cases.
  • Help Net Security, Cyberpress, and dev.to publish coverage summarizing Unit 42's Spring Ring findings, including the rise of collaboration-platform phishing alerts to 42% of all phishing alerts in the first four months of 2026.

Sources cited for "Spring Ring" Vishing Campaign Abuses Microsoft Teams, Quick

More in phishing

Detection coverage for TL-2026-2276

As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2276 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats