16 minhigh
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Spring Ring is a voice phishing operation that abused Microsoft Teams external accounts to impersonate IT help desk personnel across 150+ employees in 10+ organizations. Attackers used spoofed .onmicrosoft.com tenants to initiate chats, then transitioned to voice calls to coerce victims into executing RMM tools or custom malware. Two campaign variants were observed: Campaign A delivered an obfuscated PowerShell RAT from san-sid.com with AMSI bypass, while Campaign B used tailored S3-hosted executables and attempted PetitPotam NTLM relay attacks against domain controllers for domain-level privilege escalation.
Sens:▲ 24h
Showing defanged values
- domainsan-sid[.]comAttacker-controlled C2 domain hosting obfuscated PowerShell RAT payload; RAT beacons to this domain after disabling AMSI to download and execute further payloads
- emailhelpdesk[@]itprotectiondepartment[.]onmicrosoft[.]comAttacker identity used in Spring Ring vishing attempts; external Teams tenant designed to mimic internal IT support
- emailitadmin[@]mandatorynetworkmonitoring[.]onmicrosoft[.]comAttacker identity used in Spring Ring vishing attempts; external Teams tenant designed to mimic internal IT support
- emailithelp[@]internalsystemsdaily[.]onmicrosoft[.]comAttacker identity used in Spring Ring vishing attempts; external Teams tenant designed to mimic internal IT support
- filenameC:\ProgramData\IntegrityData\python.exeAttacker-dropped Python interpreter used in Campaign B to initiate SMB scanning and PetitPotam NTLM relay attack against domain controller
- filename\Temp\scnr-*.exePersistence copies spawned by Campaign B executable in Temp directory; wildcard pattern observed across infections
- filename\Temp\vhlp-*.exePersistence copies spawned by Campaign B executable in Temp directory; wildcard pattern observed across infections
- ip136[.]0[.]20[.]6Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip178[.]130[.]47[.]46Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip185[.]155[.]99[.]161Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip185[.]213[.]155[.]226Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip185[.]234[.]67[.]53Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip185[.]65[.]133[.]51Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip185[.]65[.]134[.]209Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip193[.]138[.]7[.]142Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip193[.]32[.]248[.]251Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip2[.]56[.]172[.]214Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip45[.]182[.]189[.]80Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip45[.]33[.]22[.]47Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip45[.]8[.]157[.]185Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip5[.]181[.]3[.]106Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip80[.]66[.]72[.]215Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- ip92[.]118[.]232[.]131Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- sha25624ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5bObfuscated PowerShell RAT dropper from Campaign A; uses variable manipulation and arithmetic obfuscation, disables AMSI via amsiInitFailed flag, encrypts host data and beacons to san-sid.com
- urlhxxps://san-sid[.]com/ownersURL hosting the obfuscated PowerShell RAT dropper downloaded via Invoke-WebRequest during Campaign A post-compromise activity
Detection / Hunteropenrouter
What Happened
Between January and April 2026, attackers used Microsoft Teams to pretend to be IT support staff at various companies. They sent chat messages from fake accounts that looked like internal help desk teams, then called victims by voice to trick them into installing remote access tools or malicious software. The attackers targeted over 150 employees at more than 10 companies. In one version of the attack, they installed a hidden remote access tool that communicated with an attacker-controlled server. In a more advanced version, they used customized download links named after the victim's company and attempted to take over the organization's central authentication server. Organizations should restrict external Teams chat access, train employees to verify unsolicited IT support contacts through known channels, and monitor for unusual external Teams conversations and rapid chat-to-call transitions.
Key Takeaways
- Spring Ring is a coordinated vishing campaign that abused Microsoft Teams external chat functionality to impersonate IT help desk personnel across 150+ employees in 10+ organizations from January to April 2026.
- Campaign A delivered an obfuscated PowerShell RAT from san-sid.com that disabled AMSI via the amsiInitFailed flag before beaconing for further payloads.
- Campaign B used tailored S3-hosted executables named after the victim's organization and username, then pivoted to PetitPotam NTLM relay attacks against domain controllers for domain-level privilege escalation.
- Attackers registered dozens of external .onmicrosoft.com tenants with names mimicking internal IT support (e.g., 'ITProtectionDepartment', 'CertifiedUpdateNetwork') to project authority.
- Detection hinges on behavioral profiling of external Teams identities: rapid chat-to-call transitions, unsolicited audio calls, and atypical RMM tool execution by non-technical users.
Affected Systems
- Microsoft Teams users with external chat enabled (Chat with Anyone feature)
- Windows endpoints
- Microsoft Active Directory Domain Controllers
- Microsoft Edge browser (sideloaded extension in Campaign B)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attackers create Microsoft Teams chats using external .onmicrosoft.com tenants with display names mimicking internal IT help desk (e.g., 'IT assistance', 'support staff')
- Social Engineering: Attackers initiate unsolicited voice calls (vishing) to coerce victims into granting remote control or executing payloads; calls last 10-15 minutes on successful attempts
- Execution (Campaign A): Attacker walks victim through launching Quick Assist or third-party RMM tools; once remote control is established, attacker downloads obfuscated PowerShell RAT from san-sid.com via Invoke-WebRequest
- Execution (Campaign B): Victim downloads tailored executable from attacker-controlled S3 bucket named with victim's company and username; executable moves to Temp directory, spawns persistence copies, and sideloads a malicious Edge extension via headless browser instance
- Discovery and Lateral Movement (Campaign B): Attacker uses dropped Python at C:\ProgramData\IntegrityData\python.exe to scan internal SMB servers and initiate PetitPotam NTLM relay attack against domain controller
- C2 and Persistence: Campaign A RAT disables AMSI via amsiInitFailed flag, encrypts host data, and beacons to san-sid.com for further payload delivery; Campaign B establishes persistence via Temp directory copies and browser extension
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Cortex XDR Analytics, Cortex XDR Identity Threat Detection, Cortex XDR UEBA
The article references Cortex XDR alert rules and a detection suite for Microsoft Teams but does not reproduce any rule content. Alert names and associated MITRE techniques are listed in Table 2 of the article. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect post-compromise activity such as RMM execution, PowerShell downloads, AMSI bypass attempts, and PetitPotam NTLM relay traffic. However, the initial vishing social engineering occurs through Teams voice calls which produce no endpoint telemetry. The headless Edge browser and sideloaded extension in Campaign B may be visible via process monitoring. |
| Network Visibility | Medium | Network monitoring can detect SMB scanning on port 445, NTLM authentication traffic to domain controllers, and C2 beacons to san-sid.com. S3 bucket access patterns with organization-specific naming may be visible through proxy logs. Teams chat metadata requires API-level access to Microsoft Teams audit logs. |
| Detection Difficulty | Hard | The initial access vector is a human-to-human voice call through a legitimate collaboration platform, which produces minimal machine telemetry. Attackers use legitimate .onmicrosoft.com tenants and legitimate RMM tools. Detection requires behavioral baselining of external Teams identity interactions and correlation between Teams metadata and endpoint activity. The obfuscated PowerShell RAT and tailored S3 executables add complexity. |
Required Log Sources
- Microsoft Teams audit logs (chat creation, call metadata)
- Microsoft 365 Unified Audit Log
- EDR process execution and command-line telemetry
- Windows Security event logs (NTLM authentication, SMB access)
- DNS resolution logs
- Web proxy logs (S3 access, C2 communication)
- Azure AD / Entra ID sign-in logs for external tenant access
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for external Microsoft Teams identities that rapidly transition from chat creation to unsolicited audio calls, as this chat-to-call pattern indicates vishing activity. | Microsoft Teams audit logs, Microsoft 365 Unified Audit Log | Initial Access | Medium; legitimate external consultants or partners may initiate calls shortly after chat creation. Consider baselining normal external communication patterns per user. |
| Consider hunting for external .onmicrosoft.com tenants with display names containing IT support keywords (help desk, IT assistance, support staff) that have no prior communication history with the organization. | Microsoft Teams audit logs, Entra ID external identity logs | Initial Access | Low to Medium; legitimate external IT vendors may use similar naming. Cross-reference with known vendor management records. |
| Consider hunting for processes executing from the Temp directory with wildcard naming patterns (e.g., vhlp-.exe, scnr-.exe) that were not launched by system update mechanisms. | EDR process execution logs, Windows Sysmon Event ID 1 | Execution and Persistence | Low; these naming patterns are atypical for legitimate software installations. |
| Consider hunting for Python executables running from non-standard paths (e.g., C:\ProgramData\IntegrityData) that initiate SMB scanning or NTLM authentication traffic to domain controllers, as this may indicate PetitPotam-based forced authentication. | EDR process telemetry, Windows Security event logs (4624, 4625), network flow logs for port 445 | Lateral Movement | Low; Python from ProgramData paths initiating SMB traffic to DCs is highly suspicious. Legitimate administrative tools typically use signed binaries from standard paths. |
| Consider hunting for PowerShell processes that modify the amsiInitFailed registry flag or attempt AMSI bypass before downloading content from external domains. | EDR command-line telemetry, PowerShell Script Block Logging (Event ID 4104), Windows registry monitoring | Defense Evasion and Execution | Low; AMSI bypass via amsiInitFailed is a well-known attacker technique with minimal legitimate use cases. |
Control Gaps
- Traditional email security gateways do not inspect Microsoft Teams chat content or voice call metadata
- Network-based IDS may not flag legitimate .onmicrosoft.com tenant traffic as suspicious since it uses Microsoft infrastructure
- Voice call content and duration are not typically logged or monitored by SIEM platforms
- Standard endpoint AV may not flag legitimate RMM tools (Quick Assist, third-party RMM) executed by users with appropriate permissions
- S3 bucket URLs with organization-specific naming may bypass URL filtering since they appear as legitimate cloud storage access
Key Behavioral Indicators
- External Teams identity creating chat with display names containing IT support keywords (help desk, IT assistance, support staff)
- Rapid transition from Teams chat creation to unsolicited audio call (chat-to-call ratio anomaly)
- Multiple short-duration call attempts (30 seconds) followed by longer successful calls (10-15 minutes) from the same external identity
- External identity approaching 5-6 different users within minutes using the same spoofed tenant
- RMM tool execution (Quick Assist, third-party RMM) by users without prior history of remote support usage
- PowerShell downloading content from external domains with subsequent AMSI bypass attempts
- Executable files in Temp directory with vhlp-* or scnr-* naming patterns
- Headless Microsoft Edge process loading extensions via command-line arguments
- Python process from C:\ProgramData\IntegrityData\ initiating port 445 traffic to internal servers
- NTLM authentication traffic from non-standard processes targeting domain controllers
- S3 URLs matching pattern <company_name>-org-filters-update-<victim_name>.s3.us-west-2.amazonaws.com
- Executable filenames matching pattern <company_name>-org-filters-update-<victim_name>.exe
False Positive Assessment
Medium: External Teams communication with legitimate partners and vendors may trigger alerts based on display name keywords or chat-to-call patterns. RMM tool usage by legitimate IT staff is normal. Organizations should baseline normal external Teams communication patterns and cross-reference alerts with vendor management records before escalating.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing Microsoft Teams external chat policies and evaluating whether the 'Chat with Anyone' feature can be restricted to approved external domains only.
- Consider blocking the identified attacker email identities and .onmicrosoft.com tenant subdomains listed in the IOCs within your Microsoft Teams admin center and email security gateway.
- If your EDR supports it, consider adding the SHA256 hash 24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b to blocklists and searching endpoint telemetry for prior execution.
- Consider blocking network communication to san-sid.com and the listed VPN/proxy source IPs at your firewall or proxy infrastructure.
- If applicable, consider hunting your Teams audit logs for external identities with IT support-related display names that have contacted users in your organization since January 2026.
Infrastructure Hardening
- Evaluate whether Microsoft Teams external access policies can be configured to allow external chat only from trusted federated domains rather than all external identities.
- Consider implementing PetitPotam mitigation by enforcing SMB signing on domain controllers and enabling the EPA (Extended Protection for Authentication) feature on IIS-hosted services.
- If supported by your environment, consider enabling Microsoft Teams conversation logging in the Microsoft Purview compliance center for audit and investigation purposes.
- Consider reviewing Entra ID conditional access policies to require additional authentication factors for external tenant access to Teams resources.
- Evaluate whether AMSI integration is enabled across all Windows endpoints and consider monitoring for amsiInitFailed registry modifications.
User Protection
- Consider deploying endpoint controls that alert on or block unsolicited RMM tool execution by non-administrative users.
- If your EDR supports process ancestry monitoring, consider configuring alerts for PowerShell processes spawned by RMM tools or browser processes.
- Consider implementing browser extension policies in Microsoft Edge to block sideloaded or unsigned extensions from loading.
- Evaluate whether URL filtering can be configured to flag S3 bucket URLs containing organization-specific naming patterns as suspicious.
Security Awareness
- Consider updating security awareness training to include Teams-specific vishing scenarios, emphasizing that legitimate IT support will not initiate unsolicited external chats or voice calls.
- Consider rolling into existing awareness programs guidance for employees to verify any IT support contact through known internal channels (e.g., internal phone numbers, ticketing system) before taking action.
- Consider training employees to recognize the Teams external user warning banner and to report unsolicited external chat requests to security teams.
- If applicable, consider adding vishing simulation exercises through collaboration platforms to existing phishing simulation programs.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Credential Access
Tactic
Discovery
Tactic
Lateral Movement
Tactic
Exfiltration
Additional IOCs
- Ips:
193[.]32[.]248[.]251- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location193[.]138[.]7[.]142- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location185[.]65[.]134[.]209- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location178[.]130[.]47[.]46- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location5[.]181[.]3[.]106- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location2[.]56[.]172[.]214- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location185[.]234[.]67[.]53- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location45[.]8[.]157[.]185- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location80[.]66[.]72[.]215- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location136[.]0[.]20[.]6- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location185[.]213[.]155[.]226- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location185[.]155[.]99[.]161- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location92[.]118[.]232[.]131- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location45[.]182[.]189[.]80- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location185[.]65[.]133[.]51- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location45[.]33[.]22[.]47- Source IP for vishing attempts; commercial VPN or proxy used to mask attacker location
- File Paths:
C:\ProgramData\IntegrityData\python.exe- Attacker-dropped Python interpreter used in Campaign B to initiate SMB scanning and PetitPotam NTLM relay attack against domain controller\Temp\vhlp-*.exe- Persistence copies spawned by Campaign B executable in Temp directory; wildcard pattern observed across infections\Temp\scnr-*.exe- Persistence copies spawned by Campaign B executable in Temp directory; wildcard pattern observed across infections
- Command Lines:
- Purpose: Local user and group enumeration to assess host and domain context | Tools:
whoami.exe,net.exe| Stage: Post-compromise discovery (Campaign A) |whoami /groups - Purpose: Domain group enumeration to identify high-value targets | Tools:
net.exe| Stage: Post-compromise discovery (Campaign A) |net group /dom - Purpose: Download obfuscated PowerShell RAT from attacker-controlled C2 server | Tools:
powershell.exe,Invoke-WebRequest| Stage: Payload delivery (Campaign A) |powershell -c Invoke-WebRequest
- Purpose: Local user and group enumeration to assess host and domain context | Tools:
- Other:
[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attempts[email protected]- Attacker identity used in Spring Ring vishing attemptsandreas[..]@idigitalserviceoperation.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedandrew[..]@hapsinfrastructureops.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedbrandon[..]@devsitoperationhub.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedbrian[..]@appssupportsys.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedchristopher[..]@adevpsitplatformops.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedchristopher[..]@itplatformops.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedclara[..]@systemsupportoperations.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redacteddaniel[..]@opsnetsupportit.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedemily[..]@apsitechsupportdesk.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactederic[..]@appopshelp.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedhenrik[..]@enterpriseoperationsflo.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedjames[..]@helpitsupportcore.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedjonathan[..]@itservicedesk.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedkevin[..]@itopsupportdesk.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedleon[..]@netcorevdapp.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedlucas[..]@applicationoperationsunit.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedmartin[..]@syslanevdapp.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedmatthew[..]@supportopsupp.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedmichael[..]@appdeploymentservices.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedpatrick[..]@infrastructureopsdesk.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedrachel[..]@ioseccloudsupport.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedrebecca[..]@infrastructureopsservice.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedrobert[..]@systemdeploymentcenter.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedryan[..]@apstechopsdeskdev.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedsarah[..]@secinfrahelpdesk.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedscott[..]@cloudinfrastr.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedsteven[..]@ittechnologyopsitdesk.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redactedthomas[..]@networkoperationsec.onmicrosoft.com- Attacker identity impersonating legitimate industry personnel; name partially redacted
Related
Stay currentSubscribe via RSS
