Threat Intelligence Brief
Curated summary with source attribution
Source: unit42.paloaltonetworks.com
Threat Risk: High
Victim: Corporate employees across multiple industries
Incident: A coordinated vishing campaign using Microsoft Teams to deploy malware and target domain controllers.
Impact: Potential for full domain compromise via NTLM relay and persistent access through RMM tools.
Attacker: Unidentified threat actors (Spring Ring)
Analysis: The ‘Spring Ring’ campaign exploits the inherent trust in collaboration tools by impersonating IT support via external Teams accounts. Attackers transition from simple chat to vishing calls to trick users into installing RMM tools or facilitating NTLM relay attacks. This demonstrates a shift toward identity-based attacks that bypass technical controls through human manipulation.
Recommendations: Restrict or disable the ‘Chat with Anyone’ feature in Microsoft Teams to limit external communication.; Implement strict multi-factor authentication and monitor for anomalous NTLM relay attempts.; Train employees to verify IT support identity through official, out-of-band channels before executing software.
Source: Unit 42, Palo Alto Networks
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source