Spring Ring Campaigns Use Microsoft Teams Vishing to Deliver Malware and Attempt NTLM Relay
Summary
Unit 42 reports that Spring Ring operators used Microsoft Teams help-desk impersonation and voice phishing to target over 150 employees at 10+ companies, delivering malware and attempting an NTLM relay attack; defenses blocked the observed activity.
Key points
- From January through April 2026, attackers used external Teams accounts posing as IT support to approach more than 150 employees across at least 10 organizations.
- During voice calls, victims were coached to run remote monitoring tools or download tailored executables; attackers made repeated attempts to reach targets.
- Campaign A used remote-control software and an obfuscated PowerShell RAT that disabled AMSI and contacted attacker infrastructure; Cortex XDR blocked execution.
- Campaign B used organization- and victim-named downloads, persistence, a hidden Edge instance, and a sideloaded browser extension.
- Campaign B attempted SMB scanning and PetitPotam-based NTLM authentication coercion against a domain controller; Unit 42 MDR blocked the domain-takeover attempt.
- Detection indicators include suspicious external Teams chats followed by unsolicited calls, help-desk impersonation, unusual RMM use, and atypical links or endpoint activity.
Article Details
- Attack Vectors
- External Microsoft Teams accounts impersonated corporate IT support and initiated voice-phishing calls to coerce employees into granting remote control or executing payloads.
- Campaign A used Quick Assist or third-party RMM software for remote access, followed by host and domain enumeration and PowerShell delivery of an obfuscated RAT.
- Campaign B directed victims to tailored cloud-hosted executables that staged copies, loaded a sideloaded Microsoft Edge extension, scanned internal systems over SMB, and attempted PetitPotam-based NTLM relay against a domain controller.
- Defensive Notes
- Educate users about unsolicited external communications and support requests on collaboration platforms.
- Monitor for newly created external chats followed rapidly by unsolicited calls, suspicious tenant identities, and unusual call patterns.
- Investigate atypical RMM execution, links to cloud-hosted files, SMB scanning from non-standard processes, NTLM activity directed at domain controllers, and authentication-coercion behavior.
- The article reports that Cortex XDR blocked Campaign A during malware execution and Unit 42 Managed Detection and Response blocked Campaign B's domain-takeover attempt.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | san-sid[.]com | Attacker-controlled domain used by the RAT to beacon and retrieve additional payloads. |
helpcenter@ithelpcenter365[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
helpdesk@itprotectiondepartment[.]onmicrosoft[.]com | Attacker identity used to impersonate internal support in vishing attempts. | |
helpdesk@newsystemmaintenance[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
helpdesk@officedesk365[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
helpdesk@officesecures[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
helpdesk@tbcsschid[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
internal@internalusahelpdeskit[.]onmicrosoft[.]com | Attacker identity used to impersonate internal support in vishing attempts. | |
it_assistance@teams0137[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
it@infrastructurefirewall[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
itadmin@mandatorynetworkmonitoring[.]onmicrosoft[.]com | Attacker identity used to impersonate internal support in vishing attempts. | |
itassistant@bilelonellc[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
ithelp@certifiednetworksec[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
ithelp@internalsystemsdaily[.]onmicrosoft[.]com | Attacker identity used to impersonate internal support in vishing attempts. | |
ithelp@itprotectiondepartment[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
ithelp@mandatorynetworkmonitoring[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
ithelpdesk@certifiedupdatenetwork[.]onmicrosoft[.]com | Attacker identity used to impersonate internal support in vishing attempts. | |
support@bilelonellc[.]onmicrosoft[.]com | Attacker identity listed among accounts used in vishing attempts. | |
| IPV4 | 136[.]0[.]20[.]6 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 178[.]130[.]47[.]46 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 185[.]155[.]99[.]161 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 185[.]213[.]155[.]226 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 185[.]234[.]67[.]53 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 185[.]65[.]133[.]51 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 185[.]65[.]134[.]209 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 193[.]138[.]7[.]142 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 193[.]32[.]248[.]251 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 2[.]56[.]172[.]214 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 45[.]182[.]189[.]80 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 45[.]33[.]22[.]47 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 45[.]8[.]157[.]185 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 5[.]181[.]3[.]106 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 80[.]66[.]72[.]215 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| IPV4 | 92[.]118[.]232[.]131 | Source IP listed as VPN/proxy infrastructure used in vishing attempts. |
| SHA256 | 24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b | SHA-256 of the obfuscated PowerShell RAT dropper. |
| URL | hxxps[:]//san-sid[.]com/owners | URL identified as hosting the obfuscated PowerShell payload used as a RAT dropper. |
MITRE ATT&CK
T1046 · Network Service DiscoveryCampaign B used SMB scanning that generated port 445 traffic toward internal servers.T1059.001 · PowerShellCampaign A used PowerShell commands and a PowerShell-based RAT.T1105 · Ingress Tool TransferPowerShell downloaded an obfuscated RAT payload from the attacker-controlled domain.T1176.001 · Browser ExtensionsCampaign B sideloaded a Microsoft Edge extension.T1187 · Forced AuthenticationCampaign B attempted to coerce the domain controller into authenticating to an attacker-controlled machine.T1204 · User ExecutionVictims were manipulated into launching RMM software or downloaded executables.T1219 · Remote Access ToolsCampaign A used legitimate RMM software to obtain remote control of victims' machines.T1557.001 · Name Resolution Poisoning and SMB RelayCampaign B attempted to relay the coerced NTLM authentication to gain domain-level privileges.T1566 · PhishingAttackers used external Microsoft Teams conversations to deliver social-engineering lures.T1566.004 · Spearphishing VoiceAttackers followed Teams chats with vishing calls to coerce employees.
Threat Actors
Vendors
MicrosoftBetween January and April 2026, we uncovered a coordinated social engineering operation that leveraged external Microsoft Teams accounts to masquerade as IT help desk personnel.Palo Alto NetworksPalo Alto Networks customers are better protected from the threats described here through the following products and services:
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS SecurityAdvanced URL FilteringAdvanced URL Filtering and Advanced DNS SecurityCortex Advanced Email SecurityCortex Advanced Email SecurityCortex Cloud Identity Threat DetectionCortex Cloud Identity Threat DetectionCortex XDRCortex XDR and XSIAMIdira Endpoint Privileged ManagerIdira Endpoint Privileged Manager (EPM)Idira Next Generation Identity (NGI) PlatformIdira Threat Detection and Response can help enable security teams to counter identity-based attacks targeting Idira Next Generation Identity (NGI) Platform and the identities it secures.Idira Privileged Access ManagementIdira Privileged Access Management (PAM)Idira Secure Infrastructure AccessIdira Secure Infrastructure Access (SIA)Idira Threat Detection and ResponseIdira Threat Detection and Response (ITDR)Microsoft 365They are used by attackers to provision Microsoft 365 tenants.Microsoft EdgeBrowser hijacking: The malware launched a hidden, headless instance of Microsoft Edge, and the attackers wrote to the disk and sideloaded an Edge extensionMicrosoft TeamsBetween January and April 2026, we uncovered a coordinated social engineering operation that leveraged external Microsoft Teams accounts to masquerade as IT help desk personnel.Quick AssistThe attacker posing as a technician walked the employee through launching built-in Windows tools like Quick Assist or downloading third-party RMM software.XSIAMCortex XDR and XSIAM