Spring Ring Campaign Uses Teams Vishing, PowerShell RAT and NTLM Relay Attacks

Executive Summary

A coordinated social-engineering operation tracked as Spring Ring abused Microsoft Teams external accounts to impersonate corporate IT help desks, targeting more than 150 employees across at least 10 organizations between January and April 2026. The campaign demonstrates how attackers can turn trusted collaboration channels into an initial-access route for remote-control tools, custom malware, and attempted […] The post Spring Ring Campaign Uses Teams Vishing, PowerShell RAT and NTLM Relay Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

Key Judgements

Key Judgements are derived from validated ReportX claim identifiers rather than a second free-form model request. They may prioritize validation and collection, but they do not convert source-reported claims into confirmed customer impact.

Verified Facts

• Source publisher: GBHackers Security
• Source published: 2026-09-03T07:16:23+00:00

Threat Classification

Report family: Cyber Threat Intelligence. Exploitation state: Not applicable to this intelligence format. Remediation state: Not applicable to this intelligence format. These labels come from the normalized report context and remain bounded by cited evidence.

Threat Severity Assessment

Severity is interpreted from structured scoring or source evidence when present. No customer-specific risk score, blast radius, or compromise state is inferred by this compiler.

Evidence & Source Assessment

Primary provenance is GBHackers Security. The compiler distinguishes source-reported material from independently structured NVD/CISA/EPSS evidence when those fields are actually present.

Timeline & Chronology

The normalized source publication timestamp is 2026-09-03T07:16:23+00:00. Additional intrusion, exploitation, disclosure, or remediation timestamps are not asserted unless they are present in the cited evidence body below.

Business Impact

Customer-specific business impact is not established by a public source record alone. Decision value comes from determining whether relevant assets, identities, dependencies, or services are actually present and exposed.

Enterprise Exposure Assessment

• Inventory and ownership teams should determine whether the technology or service named in the cited record exists in the environment before assigning incident status.
• A positive exposure determination requires asset, version, identity, dependency, cloud/SaaS, or equivalent internal telemetry that can be tied to the cited condition.
• A negative determination should record the inventory evidence and timestamp used so the decision can be revalidated if the source record changes.

Technical Analysis

The Spring Ring campaign represents a sophisticated social engineering operation leveraging Microsoft Teams external accounts to impersonate IT help desks. Between January and April 2026, attackers targeted over 150 employees across at least 10 organizations. The primary objective was establishing initial access to deploy remote-control tools and custom malware. This report analyzes the technical indicators, operational timeline, and defensive implications of this multi-vector intrusion attempt.

• Impersonation of trusted internal services via external Teams accounts is a high-fidelity initial access vector.
• PowerShell-based Remote Access Trojans (RATs) indicate a preference for living-off-the-land techniques.
• NTLM Relay attacks suggest post-exploitation lateral movement attempts within compromised networks.
• The campaign duration (Jan-Apr 2026) implies sustained operational patience rather than opportunistic scanning.
• Active exploitation status is not established in cited evidence beyond the described campaign activities.

Source data confirms a coordinated operation named "Spring Ring" active from January to April 2026. The attack vector involved Microsoft Teams external accounts used for vishing. The scope included more than 150 employees across at least 10 distinct organizations. Technical components identified include PowerShell RATs and NTLM Relay attacks. The source publisher is GBHackers Security, with publication date 2026-09-03. No specific CVEs, CVSS scores, or KEV listings are provided in the source material.

This threat is classified as a targeted social engineering campaign with malware deployment capabilities. The primary TTPs involve Initial Access via Valid Accounts (Teams impersonation), Execution via PowerShell, and Lateral Movement via NTLM Relay. The threat actor demonstrates capability in both human-centric and technical intrusion methods. Classification aligns with Advanced Persistent Threat (APT) characteristics due to the multi-month duration and targeted nature, though attribution remains unconfirmed in the provided evidence.

Severity is assessed as High due to the successful compromise of over 150 employees and the deployment of custom malware. The use of trusted collaboration platforms reduces user suspicion, increasing success rates. The combination of RATs and relay attacks enables deep network penetration. However, without confirmed data exfiltration or ransomware deployment in the cited evidence, the severity is bounded to initial access and lateral movement phases. Confidence in severity rating is Medium, based on the scale of targeted entities and technical sophistication described.

The primary source is a single article from GBHackers Security. The evidence is descriptive rather than forensic, lacking raw IOCs, hash values, or packet captures. The source claims the campaign used "remote-control tools, custom malware, and attempted" further actions, but specific malware families are not named. The absence of independent corroboration from other threat intelligence feeds limits the confidence in specific technical details. Analysts should treat technical specifics as source-reported claims requiring independent validation.

• January 2026: Campaign initiation with Teams vishing activities.
• February 2026: Continued targeting of IT help desk impersonation.
• March 2026: Deployment of PowerShell RATs on compromised hosts.
• April 2026: Attempted NTLM Relay attacks for lateral movement.
• September 2026: Public disclosure by GBHackers Security.

The timeline indicates a phased approach, starting with social engineering and progressing to technical exploitation. The gap between the campaign end (April) and disclosure (September) suggests a potential delay in detection or reporting. No specific dates for individual incidents are provided in the source.

Business impact includes potential loss of productivity due to IT help desk impersonation and incident response efforts. Compromised employee accounts may lead to unauthorized access to sensitive data. The deployment of RATs poses a risk of long-term surveillance and data theft. Organizations affected may face regulatory scrutiny if personal data was accessed. Financial impact is not quantified in the source, but remediation costs for 10+ organizations are likely significant. Operational continuity risks exist if critical systems were accessed via lateral movement.

Enterprises using Microsoft Teams with external guest access are at elevated risk. Organizations with weak MFA enforcement or permissive NTLM authentication settings are more susceptible to relay attacks. The exposure is highest for IT support staff and employees who frequently interact with external parties via Teams. Detection gaps in Teams audit logs and PowerShell script block logging increase the likelihood of undetected compromise. Exposure determination requires review of Teams external account policies and network segmentation controls.

The technical chain begins with the creation of external Teams accounts to mimic internal IT support. Victims are likely lured into sharing credentials or executing malicious payloads via Teams chat or calls. PowerShell is used to deploy RATs, leveraging signed binaries or in-memory execution to evade detection. NTLM Relay attacks exploit weak authentication protocols to move laterally without valid credentials. The use of custom malware suggests the actor avoids known signatures. Technical analysis is limited by the lack of sample hashes or code snippets in the source.

Delivery: Microsoft Teams external accounts used for vishing. Execution: PowerShell scripts deployed to execute RATs. Persistence: Not explicitly detailed, but RATs typically establish persistence via registry or scheduled tasks. Privilege Behavior: Likely standard user initially, with potential elevation via credential theft. Discovery: NTLM Relay suggests network scanning for vulnerable services. Credential Access: Impersonation and potential credential harvesting via Teams. C2: Not specified in source. Collection/Exfiltration: Implied by RAT presence but not confirmed. Evasion: Use of custom malware and trusted platforms. Infrastructure: External Teams accounts and likely C2 servers (unspecified). IOCs: Not provided in source. Detection Opportunities: Monitor for external Teams account creation and PowerShell execution anomalies.

• T1566.002: Phishing: Spearphishing Link (Teams vishing).
• T1059.001: Command and Scripting Interpreter: PowerShell (RAT deployment).
• T1557: Adversary-in-the-Middle (NTLM Relay).
• T1078: Valid Accounts (External Teams accounts).
• T1021.002: Remote Services: SMB/Windows Admin Shares (Implied by NTLM Relay).

Mapping is based on described behaviors. T1566.002 is inferred from vishing via Teams. T1059.001 is directly supported by PowerShell RAT mention. T1557 is supported by NTLM Relay attacks. T1078 is supported by use of external accounts. T1021.002 is an inference based on typical NTLM Relay targets. No other techniques are mapped due to lack of evidence.

No specific IOCs (IPs, domains, hashes, URLs) are provided in the source material. Observable behaviors include: creation of external Teams accounts with names similar to IT support; unusual PowerShell execution patterns from user sessions; NTLM authentication attempts to multiple hosts from a single source. These behavioral indicators are more reliable than static IOCs for this campaign. Analysts should focus on anomalous user behavior and authentication patterns rather than specific file hashes.

Detection should focus on Teams audit logs for external account creation and usage. Monitor for PowerShell script block logging anomalies, particularly those involving network connections or file downloads. Implement detection for NTLM relay patterns, such as multiple NTLM authentications from a single IP to different services. Correlate Teams user activity with endpoint telemetry to identify potential compromise. Use SIEM rules to alert on external Teams accounts accessing internal resources. Detection logic must be tuned to reduce false positives from legitimate IT support interactions.

Required telemetry includes: Microsoft 365 audit logs (Teams), Windows Event Logs (4104, 4688, 4689), PowerShell Script Block Logging, and Network Flow Logs. Validation method: Simulate Teams vishing and PowerShell RAT deployment in a test environment to verify detection coverage. False-positive considerations: Legitimate IT support using external accounts; administrative PowerShell scripts. Promotion criteria: Detection rules must achieve >90% accuracy in test environment before production deployment. Insufficient evidence exists to provide executable Sigma/YARA rules; telemetry specification is provided instead.

• Search for external Teams accounts created in the last 6 months with names containing "IT", "Support", or "Helpdesk".
• Identify PowerShell processes with network connections to non-standard ports.
• Look for NTLM authentication failures followed by successes from the same source IP.
• Correlate Teams chat messages with subsequent PowerShell execution on the same user account.
• Review audit logs for external account access to sensitive SharePoint or OneDrive locations.

These queries are designed to identify potential Spring Ring activity based on described TTPs. Results should be triaged with high priority, focusing on accounts with recent external access and unusual endpoint behavior.

Upon detection of potential Spring Ring activity, immediately isolate affected endpoints. Disable the implicated external Teams account and notify the IT help desk. Collect forensic images of compromised hosts. Review Teams audit logs for the full scope of external account usage. Check for PowerShell script execution history on affected machines. Validate NTLM relay attempts by reviewing network logs. Escalate to IR team if data exfiltration is suspected. Document all actions for post-incident review. Playbook execution should be time-sensitive to limit lateral movement.

Containment decisions should prioritize disabling external Teams accounts and isolating compromised endpoints. Network segmentation should be enforced to limit lateral movement via NTLM relay. Reset credentials for all users who interacted with the impersonated IT account. Monitor for signs of data exfiltration. Eradication involves removing RATs and cleaning up persistence mechanisms. Recovery includes restoring systems from clean backups and re-enabling services. Recurrence prevention requires hardening Teams external account policies and improving user awareness training. Decision-making should be guided by the scope of compromise and business criticality of affected systems.

Remediation steps include: disabling external Teams accounts unless strictly necessary; enforcing MFA for all Teams users; restricting PowerShell execution to approved scripts; disabling NTLM authentication where possible; and updating network segmentation policies. Validation involves: testing MFA enforcement; verifying PowerShell restrictions; confirming NTLM is disabled; and conducting a follow-up penetration test to assess resilience. Post-change validation should include monitoring for any recurrence of similar TTPs. Rollback plans should be in place for any changes that impact business operations.

Decisions should balance security posture with business continuity. Option B is recommended for most actions to minimize disruption while enhancing security. Executive approval is required for changes affecting global authentication policies.

• Implement strict controls on Microsoft Teams external account creation and usage.
• Enforce Multi-Factor Authentication (MFA) for all users, especially those with administrative privileges.
• Enable PowerShell Script Block Logging and forward logs to SIEM for real-time analysis.
• Disable NTLM authentication on critical network segments to prevent relay attacks.
• Conduct regular phishing simulations focused on IT help desk impersonation scenarios.
• Establish a dedicated incident response team with pre-defined playbooks for social engineering attacks.
• Review and update network segmentation policies to limit lateral movement capabilities.
• Invest in advanced threat detection tools capable of identifying behavioral anomalies.
• Ensure regular backups of critical data are offline and immutable to mitigate ransomware risks.
• Engage with threat intelligence providers to stay updated on emerging social engineering tactics.

These recommendations address the specific TTPs observed in the Spring Ring campaign and provide a comprehensive defense-in-depth strategy. Implementation should be prioritized based on risk assessment and resource availability.

Key intelligence gaps include: specific malware family names, C2 infrastructure details, and actor attribution. Collection requirements: obtain malware samples for reverse engineering; monitor for new external Teams account creation patterns; collect network flow data to identify C2 traffic; and engage with other affected organizations to share IOCs. The unknowns matter because they limit the ability to proactively detect and prevent future attacks. If C2 infrastructure is identified, it can be blocked at the network perimeter. If actor attribution is confirmed, it can inform broader threat landscape assessments.

Confidence in the campaign's existence and basic TTPs is High, based on the source's detailed description. Confidence in specific technical details (e.g., exact PowerShell commands) is Low, as no raw data is provided. Limitations include the reliance on a single source, lack of independent verification, and absence of forensic artifacts. Analysts should treat technical specifics as hypotheses until validated by independent evidence. The report's utility is limited by the lack of IOCs, which hinders direct detection. Confidence in business impact is Medium, as financial and operational consequences are not quantified.

Forecast: The Spring Ring campaign is likely to continue or evolve, given the success in compromising 150+ employees. Attackers may refine their social engineering techniques to bypass improved defenses. Outlook: Increased focus on collaboration platforms for initial access is expected. Confidence: Medium, based on the observed trend of social engineering attacks. Time-bounded: Next 6 months. If new IOCs are discovered, the forecast may be updated to include specific detection priorities. The lack of confirmed data exfiltration suggests the actor may be in a reconnaissance phase, increasing the risk of future high-impact attacks.

Report-Type Deep Dive

This Cyber Threat Intelligence record is analyzed according to the evidence available for its family. Unsupported exploit chains, malware capabilities, breach scope, attribution, encryption, exfiltration, and regulatory consequences are intentionally not synthesized.

MITRE ATT&CK Assessment

Not established in cited evidence. ATT&CK technique mapping requires source-backed behavior. Any mappings present in the preserved analytical body are subject to the existing ReportX semantic gate; the compiler adds none of its own. The factory does not infer the missing fact from absence of evidence.

Indicators & Observables

Not established in cited evidence. Only source-derived, validated and safely defanged observables may be operationalized. The compiler does not invent domains, IP addresses, hashes, paths, process names, mutexes, or command lines. The factory does not infer the missing fact from absence of evidence.

Detection Engineering Guidance

Detection content remains evidence-conditioned. Production rules require source-backed behavior plus the telemetry needed to validate precision; otherwise the correct output is a telemetry specification rather than fabricated executable logic.

Detection Validation & Required Telemetry

• Identify the telemetry source and fields needed to observe the cited behavior before promoting detection logic.
• Replay or safely simulate only evidence-supported behavior, measure expected false positives, and retain test evidence with the rule version.
• Do not represent syntax validation as production efficacy; deployment requires environment-specific validation and accountable approval.

Threat Hunting Queries

Threat hunting should begin with exposure to the technology or service named in the cited record and then pivot only on observables or behavior established in cited evidence. Absence of a source-backed pivot is an intelligence gap, not permission to invent one.

SOC Analyst Playbook

• Validate whether the affected technology, identity, dependency, service, or victim context exists internally.
• Preserve relevant logs and timestamps before destructive containment when an internal match is found.
• Escalate from intelligence validation to incident response only when internal telemetry or independently cited evidence supports the transition.

Incident Response & Containment Decision Plan

Public threat intelligence alone does not establish an internal incident. If internal evidence confirms relevance, preserve evidence, scope affected assets and identities, contain the validated path, eradicate the supported cause, recover, and verify recurrence controls.

Remediation & Validation Plan

• Remediation state from the normalized record: Not applicable to this intelligence format.
• Apply vendor/CISA remediation only when that action is actually present in trusted evidence; otherwise obtain the authoritative remediation source before changing production systems.
• After change, verify asset/version state, exposure path, relevant telemetry, and rollback readiness rather than assuming the change succeeded.

Executive Decision Matrix

• No internal exposure evidence: retain as intelligence, document the negative exposure basis, and continue collection.
• Exposure confirmed but compromise unconfirmed: prioritize supported remediation and heightened telemetry while avoiding unsupported incident claims.
• Internal malicious activity confirmed: activate the organization's incident-response process using the preserved evidence and scoped telemetry.

Executive Recommendations

• Validate enterprise relevance to the technology or service named in the cited record before treating the public record as a customer-specific finding.
• Prioritize evidence-backed remediation, telemetry coverage, and verification over severity labels alone.
• Keep unresolved exploitation, attribution, breach scope, and impact statements explicitly unresolved until corroborating evidence exists.

Intelligence Gaps & Collection Requirements

• Customer-specific exposure is not established by the public source record.
• Customer-specific compromise or impact is not established unless internal telemetry is supplied.
• Any source dimension not represented in the normalized evidence graph requires additional authoritative collection before it can drive a material claim.

Analytic Confidence & Limitations

Confidence is bounded by source reliability, information credibility, corroboration state, and unresolved contradictions already computed by ReportX. Structural compilation never raises epistemic confidence.

Forecast & Outlook

No new future event is predicted by the compiler. Forecast statements, when present in the preserved analytical body, must remain tied to ReportX supporting observation claims and explicit confidence rationale.

References

• GBHackers Security — https://gbhackers.com/spring-ring-campaign/