Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Investigation began with the Unit 42 primary report on Spring Ring, which provided a detailed account of two vishing campaigns active January–April 2026. Web searches confirmed that at least two separately tracked clusters—UNC6692 (Mandiant) and STAC4749 (Sophos)—were operating the same Teams external access impersonation vector concurrently, establishing that Spring Ring reflects a broader commoditised shift rather than an isolated incident. The KnowBe4 Phishing Threat Trends Report Vol. 7 independently corroborated the 41% surge in Teams-based attacks cited in the source article. No CVEs were identified and no government advisory was found; the attack surface is entirely behavioural and platform-configuration-based.

1. What are the full technical details, scope, and IOCs of the Spring Ring campaign?
   Fetched the Unit 42 primary report.
   unit42.paloaltonetworks.com ↗

   Two-campaign breakdown confirmed: Campaign A (Quick Assist → AMSI-bypass PowerShell RAT, C2 san-sid[.]com); Campaign B (S3 dropper → Edge extension → PetitPotam NTLM relay attempt). 26 attacker identities, 48+ spoofed accounts, 150+ targets across 10+ organisations. No CVEs exploited.

   why Establishes the authoritative primary account of the event, tools, infrastructure, and IOCs.

2. Are there independent reports of Teams vishing with similar TTPs operating in the same period?
   Searched for Microsoft Teams vishing IT help desk social engineering 2026.

   Multiple independent campaigns identified: UNC6692 (Mandiant, April 2026), STAC4749/Chaos ransomware (Sophos, February–June 2026), and CyberProof H1 2026 analysis—all use the same external Teams tenant impersonation pattern.

   why Confirms Spring Ring is not isolated; the Teams external access vector is being exploited by multiple distinct clusters simultaneously, elevating the assessment from a single campaign to a class of threat.

3. Does the UNC6692 reporting provide attribution or additional technical context?
   Fetched the Hacker News article on UNC6692.
   thehackernews.com ↗

   UNC6692 attributed to former Black Basta affiliates; uses distinct SNOW malware ecosystem (SNOWBELT, SNOWGLAZE, SNOWBASIN); targets senior executives; achieves lateral movement via pass-the-hash. No CVEs. Not directly linked to Spring Ring.

   why Adds actor context and a named malware family to the broader threat picture, though UNC6692 and Spring Ring remain unlinked by published evidence.

4. What is STAC4749's connection to this threat trend and what are the downstream impacts?
   Fetched the Bleeping Computer article on Teams vishing leading to Chaos ransomware.
   bleepingcomputer.com ↗

   STAC4749, linked to former Conti/Royal/BlackSuit affiliates, targeted dozens of North American organisations Feb–June 2026 via Teams impersonation. Achieved encryption in under 17 hours in one case. Canada (50%) and US (45%) primary targets.

   why Provides the ransomware end-game context absent from Spring Ring's own reporting, confirming the same vector is being monetised by ransomware-affiliated groups.

5. Does the KnowBe4 report independently confirm the 41% Teams phishing surge cited in the Unit 42 article?
   Fetched the KnowBe4 2026 Phishing Threat Trends Report Vol. 7.
   knowbe4.com ↗

   Report confirms Teams attacks surged 41% in six months. Also notes 84.4% of successful phishing now passes DMARC verification, underlining why platform-trust exploitation is effective.

   why Independent statistical corroboration from a separate security vendor, validating the scale of the Teams-based phishing trend described by Unit 42.

6. Does the CyberProof H1 2026 analysis provide independent sector-specific detail?
   Fetched the CyberProof H1 2026 Microsoft Teams vishing analysis.
   cyberproof.com ↗

   Confirms financial services and healthcare as targeted sectors; identifies SINDOOR malware in one incident; notes Iranian state-aligned actors among suspected threat groups. Call durations averaged approximately 20 minutes.

   why Extends the sector scope beyond what Unit 42 disclosed and adds a state-aligned actor dimension, though SINDOOR is not linked to Spring Ring specifically.

7. Are there any government or vendor advisories specifically addressing this Teams external access attack surface?
   Searched for CISA or Microsoft advisories on Teams external access vishing 2026.

   No government advisory directly addressing Spring Ring or the Teams external access vishing pattern was found in search results.

   why Absence of formal advisory is a material gap; defenders must rely on vendor detection guidance and manual configuration hardening rather than a directed remediation notice.