Spring Ring: From Microsoft Teams Voice Phishing to RMM, RAT, and NTLM Relay

1. Overview Article Title : Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams Source : Unit 42 Published Date : 2026-08-31 Original Source : Unit 42 Related Sources : None Related Malware, Threat Groups, CVEs, Products : Spring Ring, PowerShell RAT, Microsoft Teams, Microsoft Quick Assist, Microsoft Edge, Active Directory Severity : High 2. Executive Summary Spring Ring uses external Teams accounts to impersonate corporate IT staff. It uses voice calls to trick targets into running RMM tools or custom malware. In advanced cases, the campaign attempts NTLM Relay against domain controllers using PetitPotam. 3. Attack Flow From External Teams Chat to Attempted Domain Privilege Escalation The attacker sets up an external onmicrosoft.com tenant and a display name to impersonate the IT department. The attacker sends a one-on-one Teams chat to the target, followed immediately by a voice call to build trust and urgency. In Campaign A, the attacker tricks the target into running an RMM tool like Quick Assist to enumerate devices and the domain. The attacker downloads an obfuscated PowerShell RAT, attempts to bypass AMSI, and connects to the C2 server. In Campaign B, the attacker delivers an executable file via an S3 URL tailored to the target, establishing persistence, a hidden Edge instance, and extensions. The attacker uses Python to scan internal TCP/445 and triggers NTLM authentication toward the domain controller. The attacker forces authentication using PetitPotam and attempts to gain domain privileges via NTLM Relay, though this was blocked in observed cases. 4. Attacker Positioning and Execution Location External attackers connecting to Teams from a Microsoft 365 external tenant. After running RMM or malware, the attacker reaches the internal network and Active Directory from the user device. 5. Victim and Administrator Visibility Victim Receives a chat and voice call on Teams from a display name that looks like internal IT staff, followed by