Spring Ring: From Microsoft Teams Voice Phishing to RMM, RAT, and NTLM Relay
1. Overview Article Title : Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams Source : Unit 42 Published Date : 2026-08-31 Original Source : Unit 42 Related Sources : None Related Malware, Threat Groups, CVEs, Products : Spring Ring, PowerShell RAT, Microsoft Teams, Microsoft Quick Assist, Microsoft Edge, Active Directory Severity : High 2. Executive Summary Spring Ring…
Spring Ring is a sophisticated voice phishing campaign targeting Microsoft Teams users. The attackers create external Microsoft Teams accounts to impersonate corporate IT staff, using voice calls to deceive targets into running remote monitoring and management (RMM) tools or custom malware. In some cases, the attackers attempt to perform NTLM Relay against domain controllers using PetitPotam.
The attack begins with an external Teams chat or voice call from an external tenant, impersonating IT staff. The attacker quickly establishes trust by prompting the target to run an RMM tool or execute an executable file. For Campaign A, the target is tricked into running a legitimate RMM tool like Quick Assist to enumerate devices and the domain.
For Campaign B, the attacker delivers a malicious executable via a specially crafted S3 URL, establishing persistence and a hidden Edge instance. The attacker then scans internal TCP/445 and triggers NTLM authentication toward the domain controller, attempting to force authentication using PetitPotam and gain domain privileges.
Attackers operate from external Microsoft 365 tenants, connecting to Teams and ultimately reaching the internal network and Active Directory from the user device. Administrators should be aware of unusual RMM usage, PowerShell activity, customized S3 URLs, hidden Edge instances, and SMB/EFSRPC traffic. Success depends on the attacker's ability to establish Teams chats and calls with the target, who believes the attacker is IT staff and proceeds with the requested actions.
To mitigate risk, organizations should limit external Teams communication to necessary business needs, verify external callers through separate channels, and approve third-party RMM tools. Enabling PowerShell controls, AMSI, application control, and EDR is essential. Strengthening NTLM Relay defenses, such as SMB signing, NTLM restrictions, and Extended Protection for Authentication, can also help prevent successful attacks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
