Loading story…
Unit 42 identified Spring Ring, a coordinated social-engineering operation that used external Microsoft Teams accounts posing as IT help-desk staff to target more than 150 employees at at least 10 organizations. Between January and April 2026, operators combined Teams chats with voice-phishing calls to create urgency and persuade victims to install remote-monitoring-and-management tools or execute malware—a vishing approach aligned with MITRE ATT&CK technique T1566.004.
One campaign obtained remote access, enumerated hosts and domains, and delivered an obfuscated PowerShell RAT dropper from san-sid[.]com; the dropper disabled AMSI before retrieving additional payloads. A second campaign used tailored executables for persistence, launched a headless Edge browser with a sideloaded extension, scanned SMB services, and attempted a PetitPotam-based NTLM relay attack against a domain controller for domain-level privileges. Cortex XDR blocked observed malware execution, while Unit 42 Managed Detection and Response stopped the attempted domain takeover.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Between January and April 2026, the Spring Ring operation used external Microsoft Teams accounts impersonating IT help desk and administrator staff to target more than 150 employees across at least 10 organizations. Operators escalated Teams chats into vishing calls to induce victims to grant remote access or execute malicious tools; Unit 42 found no evidence of a Microsoft Teams or Microsoft 365 compromise.
A Teams and Quick Assist social-engineering campaign delivered update-themed malicious MSIs that installed a portable Node.js runtime and encrypted JavaScript implant with per-user persistence, HTTPS polling, reconnaissance, and screenshot capture. Operators then enumerated Active Directory and used WinRM to access domain-joined systems including domain controllers and certificate authorities.
After obtaining Windows Quick Assist access, operators deployed malicious MSI installers from Amazon S3 that used signed applications such as Kodi, Salamander, and FileZilla to sideload malicious DLLs. The DLLs communicated with AWS API Gateway endpoints, used WMI to launch reverse-shell agents, and established persistence through a Startup-folder shortcut; the disclosure supplied related domains and SHA-256 hashes.
Researchers reported Spring Ring infrastructure including san-sid.com, 16 associated IP addresses, and SHA-256 hash 24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b. The disclosure also identified IT-support-themed onmicrosoft.com accounts used to impersonate help-desk personnel in Teams.
In Campaign B, tailored Amazon S3-hosted executables established persistence, launched headless Edge with a sideloaded extension, and scanned internal systems over SMB. The activity attempted PetitPotam-based authentication coercion and NTLM relay against a domain controller for domain-level privileges, but Unit 42 Managed Detection and Response blocked the takeover attempt.
In Campaign A, attackers persuaded victims to use Windows Quick Assist or install remote-monitoring-and-management software, then enumerated host and domain groups. They downloaded an obfuscated PowerShell RAT dropper from san-sid[.]com that disabled AMSI, collected and encrypted host data, and beaconed for additional payloads; Cortex XDR blocked execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
18 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcecyberveille.ch
Open sourcedecipher.sc
Open sourcescworld.com
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceknowbe4.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026
Attackers used **email bombing** and fake IT support messages over **Microsoft Teams** to trick employees into launching **Windows Quick Assist**, giving remote access that led to the deployment of **Nimbus RAT**. eSentire said the campaign targeted corporate organizations globally, with notable impact on the legal sector, and observed a full compromise path from Teams contact to RAT execution in under 20 minutes. In one documented intrusion, the victim received more than 280 legitimate subscription emails before being contacted by an actor-controlled Teams account, then was directed to download malware from a compromised **Microsoft 365** tenant hosted on **SharePoint**. Nimbus RAT is a Java-based backdoor bundled with **OpenJDK** to run on Windows systems and uses **Google Drive** and **Google Sheets** for command-and-control, helping malicious traffic blend into normal SaaS activity. Researchers said the malware supports command execution, file and registry manipulation, screenshot capture, in-memory payload execution, and credential theft, while a secondary tool, **InboxSetupPro**, uses **OneDrive** for exfiltration and steals communications data including **Signal** attachments and large offline email archives. eSentire reported **1,540** similar Teams-related events across **172** customer environments, with activity rising sharply from December 2025 through March 2026, prompting recommendations to restrict external Teams communications, disable Quick Assist where possible, monitor transfers to public cloud storage, and train users to spot email-flooding and fake helpdesk tactics.
Jun 29, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026