The Numbers Behind the Breach
Over 150 employees across more than 10 organizations. Twenty-six distinct attacker identities. A four-month operational window spanning January through April 2026. These figures, disclosed by Palo Alto Networks Unit42 on August 31, 2026, describe a campaign designated "Spring Ring" and attributed to Cloaked Ursa, a threat actor associated with APT29 and Muddled Libra.
The attack chain did not begin with a software vulnerability. It began with a Microsoft Teams chat.
Context: The Default-Open Problem
Microsoft Teams external access is enabled by default in most M365 tenants. The setting that allows external users to contact organizational users frequently remains active. This configuration, designed for collaboration efficiency, has become a structural attack surface.
The Spring Ring campaign exploited this default posture. Attackers registered .onmicrosoft.com tenants and adopted professional display names such as "ITProtectionDepartment" to impersonate IT help desks. From there, they initiated unsolicited chats and voice calls with targeted employees.
This is not an isolated incident. KnowBe4 data indicates Teams-based attacks grew 41 percent between October 2025 and March 2026. Unit42 Cortex telemetry shows collaboration-tool phishing alerts now account for 42 percent of all phishing alerts, up from 30 percent in the preceding four months.
Core: The Two-Wave Attack Architecture
Unit42 documented two distinct campaign waves, each with different technical characteristics.
Campaign A deployed remote monitoring and management (RMM) tools alongside an obfuscated PowerShell RAT hosted at san-sid.com. The operators disabled AMSI, performed local enumeration, and established persistence. Cortex XDR blocked this wave during execution.
Campaign B demonstrated greater sophistication. Files hosted on S3 buckets were named with victim company names and usernames, indicating prior reconnaissance. The operators generated persistence mechanisms, leveraged headless Edge browser hijacking, and escalated to PetitPotam NTLM relay attacks against domain controllers.
The complete chain follows a sequential path: Teams chat, vishing, RMM access, NTLM relay, Pass the Hash (T1550.002), and ultimately domain-level privileges.
What distinguishes Campaign B is the delivery mechanism. The progression from a collaboration-platform conversation to full domain compromise bypasses traditional boundary defenses entirely. No email gateway inspection occurs. No firewall rule triggers. The initial entry point is a trusted communication channel.
The Contrarian Angle: Correlation Does Not Equal Causation
The security industry will likely frame this as a Microsoft Teams problem. That framing is incomplete.
Teams is the entry vector, but the domain compromise succeeded because of legacy authentication infrastructure. PetitPotam (CVE-2021-36942) was patched in August 2021. Its continued exploitability in 2026 indicates that victim organizations failed to remediate known vulnerabilities for over four years. The attack surface was not created by Teams alone; it was enabled by unpatched Active Directory Certificate Services components and an over-reliance on NTLM.
Based on my audit experience across enterprise environments, the pattern is consistent. Organizations adopt modern collaboration tools while deferring legacy protocol remediation. The result is a trust disconnect: the modern layer assumes the legacy layer is secure, and the legacy layer assumes the modern layer is isolated. Neither assumption holds.
The Microsoft security blog from April 18, 2026, described a cross-tenant help desk impersonation playbook matching the Spring Ring pattern: Teams impersonation leading to Quick Assist sessions, WinRM lateral movement, and Rclone data exfiltration. This confirms the attack is not a single anomaly but a repeatable methodology.
The Structural Vulnerability
Teams external access functions as an open API to every employee in an organization. Any entity with a registered tenant can initiate contact. The platform lacks dynamic tenant reputation systems, domain verification requirements, or risk scoring for newly created tenants.
This is not a zero-day exploit. It is a configuration default that prioritizes growth over security. The platform's network effects—the very reason organizations adopt Teams—become the attack surface. Every employee is a potential entry point, and the help desk impersonation angle exploits the one role employees are conditioned to trust.
The Exchange Auth Bypass vulnerability (CVE-2026-62911) adds context: 21,899 unpatched servers remain exposed. The pattern across Microsoft's ecosystem is consistent—known vulnerabilities persist because organizations lack the operational capacity to remediate at scale.
Takeaway: The Next Signal
The Spring Ring campaign demonstrates that identity-layer attacks will continue to outpace endpoint and application-layer defenses. The question for security teams is not whether Teams external access should be disabled—it is whether your organization can detect the difference between a legitimate external collaborator and a registered tenant with a convincing display name.
Monitor for newly created tenants initiating contact with your organization. Track RMM tool installations originating from chat-initiated sessions. Audit NTLM usage across your environment. The next campaign will not announce itself. It will arrive as a Teams notification from someone who sounds like they belong.