We didn't see it coming through an unpatched zero-day or an exotic exploit chain. We didn't need to. The Spring Ring campaign, disclosed by Palo Alto Networks Unit42 on August 31, 2026, didn't breach a single firewall or crack a single password hash to get its foot in the door. It just opened Microsoft Teams and started chatting.
Between January and April 2026, attackers linked to Cloaked Ursa—the threat group also tracked as APT29 and Muddled Libra—turned the world's most ubiquitous enterprise collaboration tool into a domain compromise machine. Over ten organizations and 150 employees were targeted. The kicker? The entire operation ran through the default configuration of Microsoft 365 tenant trust boundaries.
The Attack Chain: From Chat to Domain Admin
The anatomy of Spring Ring reads like a case study in modern identity-layer attacks. It started with attackers registering their own .onmicrosoft.com tenants and crafting professional display names—"ITProtectionDepartment," "Help Desk Support," the kind of labels that make employees click "Accept" without a second thought.
From there, the chain progressed with chilling efficiency:
Campaign A deployed RMM (Remote Monitoring and Management) tools and an obfuscated PowerShell RAT hosted at san-sid.com. The attackers disabled AMSI (Antimalware Scan Interface) and performed local enumeration. Cortex XDR caught and blocked this wave mid-execution.
Campaign B was more surgical. Files hosted on S3 buckets were named with victim company names and usernames. The attackers established persistence mechanisms and hijacked headless Edge browser sessions. Then came the escalation: PetitPotam NTLM relay attacks targeting domain controllers, leading to Pass the Hash (T1550.002) and full domain-level privileges.
The complete path: Teams chat → vishing → RMM access → NTLM relay → Pass the Hash → domain compromise.
This isn't a novel exploitation of a software vulnerability. It's the weaponization of organizational trust, packaged in the convenience of Microsoft's default collaborative features.
The Data Behind the Threat
The numbers paint a stark picture of where enterprise security is heading. Teams-based attacks grew 41% between October 2025 and March 2026, according to KnowBe4. Unit42's Cortex telemetry shows collaboration-tool phishing alerts now account for 42% of all phishing alerts, up from 30% in the preceding four months.
Microsoft's own security blog from April 18, 2026 describes a cross-tenant help desk impersonation playbook with striking similarities to Spring Ring: Teams impersonation leading to Quick Assist sessions, WinRM lateral movement, and data exfiltration via Rclone.
The threat landscape extends beyond Teams. The report also flags CVE-2026-62911, an Exchange auth bypass vulnerability, with 21,899 unpatched servers still exposed. Combined with PetitPotam—a vulnerability patched back in August 2021—the message is clear: hybrid environments remain riddled with legacy components that NTLM relay attacks can still abuse.
The Default-Open Problem
Here's what keeps me up at night: Teams external access is enabled by default in most M365 tenants. The ability for external users to chat with organizational users is commonly left on. No software vulnerability required—just a registered tenant and a convincing voice.
This is the security design philosophy I've been tracking for years: the tension between product growth and security boundaries. Teams optimized for frictionless collaboration, and in doing so, created an attack surface that bypasses traditional perimeter defenses entirely.
The attackers didn't need to exploit a flaw in Teams. They used it as designed. The platform's default-open posture toward external communication, combined with the implicit trust employees place in internal collaboration tools, created the perfect phishing environment.
The Contrarian View: Collaboration Tools Are the New Perimeter
We've spent two decades building email security gateways, training employees to spot phishing in their inboxes. But the collaboration layer—Teams, Slack, Webex—has largely escaped equivalent scrutiny. Employees are conditioned to treat a message from a colleague's name in Teams with more trust than a suspicious email.
The data confirms this blind spot. While email remains the top phishing vector, collaboration tools are closing the gap rapidly. Attackers follow trust. They follow where employees spend their digital hours. And they follow the path of least resistance.
The deeper issue is architectural. Microsoft's hybrid identity model—Active Directory paired with cloud services—creates a trust disconnect. Modern collaboration layers connect to legacy authentication protocols. NTLM relay attacks like PetitPotam work because the legacy protocol remains active for compatibility. The modernization of the front door (Teams, cloud collaboration) rarely includes the modernization of the back office (authentication protocols, domain trust models).
From my experience auditing enterprise security postures, the pattern is consistent: organizations deploy cutting-edge endpoint detection and cloud access controls while leaving legacy authentication protocols untouched. This gap between modern security investment and legacy infrastructure exposure is exactly where campaigns like Spring Ring thrive.
The Takeaway: Identity Is the New Battlefield
Spring Ring isn't an anomaly. It's a preview of the future of enterprise attacks. The attackers didn't need a zero-day. They needed a default configuration and human psychology.
For organizations running Microsoft Teams, the mitigation path is clear but requires action: restrict external access to approved domains only, disable external chat where business needs don't require it, implement conditional access policies that flag first-contact external entities, and—critically—develop a timeline for disabling NTLM in hybrid environments.
We didn't see Spring Ring coming through a firewall alert. We saw it through a Teams notification. The question isn't whether your organization will face a similar campaign. It's whether your collaboration layer will be the door that lets it in—or the tripwire that catches it.