The Weaponization of Teams External Access
Microsoft Teams is a collaboration tool, but its default configuration makes it a viable identity attack surface. The Spring Ring campaign, disclosed by Unit42 researchers on August 31, 2026, demonstrates how attackers exploit the platform’s external access features to bypass traditional perimeter defenses. By abusing the default “Chat with Anyone” setting, threat actors impersonate internal IT help desks to establish initial access, turning a trusted communication channel into a delivery mechanism for malicious payloads.
Collaboration-Based Phishing Is Increasing
The numbers are concrete. KnowBe4 data indicates Teams-based attacks rose 41% between October 2025 and March 2026. Unit42 Cortex telemetry shows collaboration tool phishing alerts now account for 42% of all phishing alerts, up from 30% in the preceding four months. A Microsoft Security Blog entry from April 18, 2026 detailed a cross-tenant helpdesk impersonation playbook with the same pattern: Teams impersonation leading to Quick Assist sessions, WinRM lateral movement, and data exfiltration via Rclone. Attackers exploit the trust users place in internal-looking communication.
The Mechanics of Spring Ring
Active between January and April 2026, the campaign targeted over 150 employees across more than 10 organizations. Attributed to Cloaked Ursa—also known as APT29 or Muddled Libra—the operation used 26 distinct attacker identities. The actors registered .onmicrosoft.com tenants with professional display names such as “ITProtectionDepartment,” “MandatoryNetworkMonitoring,” and “Help Desk Support” to initiate unsolicited chats and voice calls.
Two campaign variants emerged. Campaign A deployed RMM tools and an obfuscated PowerShell RAT from san-sid.com. The RAT attempted to disable AMSI via the amsiInitFailed flag and performed local enumeration using commands like “whoami /groups” and “net group /dom.” Cortex XDR blocked it during execution.
Campaign B was more targeted. Attackers hosted executables on S3 buckets with filenames personalized to the victim—”company_name-org-filters-update-victim_name.exe.” These spawned persistence mechanisms (vhlp-*.exe, scnr-*.exe), employed headless Edge browser hijacking, and escalated to PetitPotam NTLM relay against domain controllers.
Legacy Technique, Novel Delivery
Campaign B’s use of PetitPotam to coerce domain controller authentication is not new. PetitPotam (CVE-2021-36942) was patched in August 2021. What is new is the delivery mechanism: a Teams chat that chains through vishing to RMM access to NTLM relay, reaching domain-level privileges via Pass the Hash (T1550.002). Unit42 MDR blocked the domain-takeover attempt, but the path from external chat to full domain compromise was demonstrated as viable.
The Broader Identity Pattern
Spring Ring fits a pattern this beat has tracked across multiple vectors. Exchange Auth Bypass (CVE-2026-62911) exposed 21,899 unpatched servers. Entra ID (CVE-2026-69836) targeted identity infrastructure directly. SonicWall SMA1000 chained authentication bypass to session hijacking. The common thread: attackers are prioritizing the identity layer over endpoint or application-specific vulnerabilities.
Teams external access is enabled by default in most M365 tenants. The setting “External users with MS Teams accounts not managed by an organization can contact users in my organization” is frequently left on. Organizations that have not explicitly restricted federation to authorized domains are exposing an attack surface that requires no software exploit—only a registered tenant and a convincing voice.