Executive Summary
Between January and April 2026, a sophisticated social engineering operation dubbed 'Spring Ring' targeted over 150 employees across at least 10 organizations. The threat actor, suspected to be Cloaked Ursa (APT29), leveraged external Microsoft Teams accounts to masquerade as IT help desk personnel. By exploiting the 'Chat with Anyone' feature, the attackers initiated unsolicited voice calls (vishing) to establish trust and manipulate victims into executing malicious payloads.
Technically, the campaign utilized two distinct execution paths: one involving the deployment of legitimate Remote Monitoring and Management (RMM) tools to deliver an obfuscated PowerShell-based RAT, and a more advanced variant utilizing tailored cloud endpoints. In the latter, attackers attempted to gain domain-level privileges by launching NTLM relay attacks against domain controllers using the PetitPotam tool (T1557.001).
This activity underscores a critical shift where collaboration platforms are weaponized to bypass traditional email security. The use of professional personas, spoofed .onmicrosoft.com domains, and real-time human interaction presents a significant risk to enterprise identity perimeters and requires immediate attention to SaaS-based behavioral monitoring.