A coordinated operation has targeted at least 150 Microsoft Teams users across multiple companies with voice phishing (vishing) attacks aimed at installing remote monitoring and management (RMM) and malware tools onto their machines. The campaign also attempts in some instances to compromise organizations' domain controllers.
Researchers from Palo Alto Networks observed the operations — which they've dubbed "Spring Ring" — between January and April attacking employees across at least 10 organizations, according to a report published this week. The campaign illustrates a growing shift away from traditional email phishing toward attacks conducted through trusted enterprise collaboration platforms, which adds authenticity to the interaction.
"The Spring Ring operation represents an evolution from previous campaigns by merging vishing into the Teams workflow," Noam Sala, a Palo Alto Networks staff researcher, wrote in the post. "This shift moves the attack from a passive click-and-harvest model to a real-time engagement."
Attacks begin with a benign chat that is actually a vishing call, during which adversaries try to coerce victims into executing remote monitoring and management (RMM) tools or custom malware. A more advanced variant of the attack goes even further, with attackers moving from a vishing call "to a full-blown Microsoft NT LAN Manager (NTLM) relay attack aimed at an organization's domain controller (DC)," Sala added.