The message lands in Microsoft Teams. No email gateway inspects it. No firewall flag is raised. The sender's display name reads "ITProtectionDepartment" — a professional label designed to trigger one response: compliance.

The voice call follows within minutes. The caller's tone is calm, authoritative, helpful. A password reset is needed. A quick Remote Monitoring and Management (RMM) tool installation will solve everything.

That single voice call, routed through a collaboration platform trusted by 300 million daily users, eventually led to domain controller compromise. Not via a zero-day exploit. Not through a sophisticated endpoint bypass. Through a default-enabled configuration that most organizations never realized was an attack surface.

Palo Alto Networks Unit42 disclosed the "Spring Ring" campaign on August 31, 2026. Active from January through April, attributed to Cloaked Ursa (APT29 / Muddled Libra), the operation targeted more than 10 organizations and over 150 employees. The attack chain: Teams chat to vishing to RMM access to NTLM relay to Pass-the-Hash to domain-level compromise.

Pulse on the chain, breath in the market. This is not another phishing alert. This is a structural vulnerability in how modern enterprises trust their collaboration layer.

The attack surface isn't a bug. It's a configuration choice made by Microsoft — and left unexamined by thousands of enterprise tenants.

Context: The Collaboration Layer As Trust Anchor

Microsoft Teams external access is enabled by default in most M365 tenants. External users — including those with self-registered .onmicrosoft.com domains — can initiate chats and voice calls with internal employees. The setting "External users can contact me" is frequently left in its default state: on.

Microsoft's security blog from April 18, 2026, described the cross-tenant help desk impersonation playbook. The pattern matches Spring Ring precisely: Teams impersonation leading to Quick Assist sessions, WinRM lateral movement, and data exfiltration via Rclone.

This isn't an obscure misconfiguration. KnowBe4 data shows Teams-based attacks grew 41% between October 2025 and March 2026. Unit42 Cortex telemetry indicates collaboration-tool phishing alerts now represent 42% of all phishing alerts — up from 30% in the preceding four months.

Attackers follow trust. Email gateways became effective at filtering malicious content, so attackers moved to a platform where messages bypass those filters entirely. Teams conversations carry implicit authority — they appear inside the sanctioned corporate communication tool. Employees are trained to distrust email. They are not trained to distrust a Teams call from a display name that matches the IT department.

The numbers tell the story: 26 attacker identities, professional display names like "ITProtectionDepartment" and "Help Desk Support," and a full campaign lifecycle spanning four months before systematic disclosure.

Core: Anatomy of a Two-Wave Assault

Running where the liquidity flows fastest — in this case, flowing toward the path of least resistance.

Spring Ring unfolded in two distinct campaigns, each with different tactics and objectives.

Campaign A: The Broad Sweep

Campaign A deployed RMM tools and an obfuscated PowerShell RAT hosted at san-sid.com. The attackers disabled AMSI (Antimalware Scan Interface) and performed local enumeration to map the environment. Cortex XDR detected and blocked this wave.

Campaign B: The Surgical Strike

Campaign B was more targeted. Executables hosted on S3 buckets were named with the victim company name and username — a level of personalization indicating prior reconnaissance. The attackers established persistence mechanisms and leveraged a headless Edge browser for session hijacking. The final step: escalation to PetitPotam NTLM relay attacks against domain controllers.

The full kill chain:

Teams chat → vishing → RMM access → NTLM relay → Pass-the-Hash (T1550.002) → domain-level permissions

Each step is individually detectable. The combination is what makes this dangerous. The entry point — a Teams chat from an unknown external tenant — is precisely where most organizations have zero visibility and zero controls.

What stands out in Campaign B is not the technical sophistication of individual steps. PetitPotam (CVE-2021-36942) was patched in August 2021 — five years before this campaign. The novelty lies in the delivery mechanism: a trusted collaboration platform serving as the initial access vector, bypassing every traditional boundary defense.

From my surveillance experience, the pattern is clear. Attackers aren't looking for new exploits. They're looking for new trust paths. Teams external access is the largest unguarded trust path in modern enterprise architecture.

Consider the technical reality: Exchange Auth Bypass (CVE-2026-62911) exposes 21,899 unpatched servers. PetitPotam remains exploitable in hybrid environments. Active Directory and NTLM remain the backbone of enterprise identity. Add a collaboration platform with default-external-contact and you have an identity attack surface that requires no software vulnerability — just a registered tenant and a persuasive voice.

Contrarian: The Platform's Security Debt Is the Attackers' Roadmap

Here's the angle most coverage misses: this campaign is a product-security failure, not just a threat-actor success.

Microsoft Teams was designed for growth. Default-external-access maximizes collaboration and viral adoption. But the security implications were deferred to customers — thousands of understaffed IT teams who never configured the platform for least privilege.

The platform's own telemetry reveals the problem. Teams-based attacks grew 41% because the platform is a honeypot of implicit trust. Users see "Teams" and think "internal." They don't distinguish between their tenant and a maliciously registered external tenant. They see "ITProtectionDepartment" and think "authorized."

This is a fundamental design flaw: a platform that enables cross-tenant communication without cross-tenant reputation or trust verification. In social platforms, connection requests require mutual acceptance. In Teams, external users can directly initiate chats and calls — and the platform provides no red-flag warning for first-contact or newly-created tenants.

Another blind spot: the hybrid identity gap. Organizations invested heavily in endpoint detection and response (EDR) and modern cloud security. But the attack path bypasses endpoints at the entry point — it's a human clicking a link in a chat — and then pivots to legacy NTLM protocols that were supposed to be deprecated years ago.

The attack succeeded because of a trust gap between the collaboration layer and the identity layer. Modern Teams. Legacy NTLM. No bridge of verification between the two.

Based on my audit experience in enterprise environments, the remediation path is uncomfortable: organizations must assume external Teams communication is hostile by default. This requires re-architecting trust, not just adding another security tool.

The 42% collaboration-tool phishing alert share — up from 30% — is the canary in the coal mine. Attackers have found the path of least resistance and are scaling it.

Takeaway: The Next Wave Is Already Forming

What comes after Spring Ring? The campaign is already over, but the playbook is now public. Every commercial cybercrime group has access to the same threat intelligence.

The attack surface remains: Teams external access is still enabled by default. NTLM is still active in most hybrid environments. PetitPotam variants still exist.

The response requires both sides of the equation. Platform-side: Microsoft must implement external-tenant reputation systems, first-contact warnings, and default-deny external communication policies. Enterprise-side: security teams must treat Teams as an untrusted entry point, implement conditional access policies for external chats, and accelerate NTLM deprecation.

Sensing the tremor before the earthquake hits — the tremor was Spring Ring. The earthquake is the inevitable copycat campaign.

Seventy-two hours without sleep, zero doubts: the next attack will not come through email. It will come through a platform your employees trust implicitly. The question is whether your security architecture is ready for a threat that doesn't need to exploit a vulnerability — just a default setting.

Caught in the flash, framed in fact. The fact is: Spring Ring is not an anomaly. It is a preview of the identity attack surface that will define enterprise security in the post-email era.

Secure your Teams. Disable unnecessary external access. Audit your NTLM exposure. Assume every collaboration request is hostile until verified.

The market is moving. The collaboration layer is the new attack frontier. Act accordingly — because the next campaign is already in progress.