Full Report
Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams appeared first on Unit 42.
Analysis Summary
# Tool/Technique: Spring Ring Campaign (Vishing & Teams Abuse)
## Overview
The "Spring Ring" campaign is a sophisticated social engineering operation that leverages a multi-stage attack vector involving voice phishing (vishing) and Microsoft Teams abuse. The primary goal is to deceive enterprise employees into installing remote monitoring and management (RMM) tools, which are subsequently used to deploy malware, perform lateral movement, and ultimately target Domain Controllers for full environment compromise.
## Technical Details
- **Type:** Multi-stage Technique / Malware Delivery Framework
- **Platform:** Windows (Enterprise environments)
- **Capabilities:** Credential theft, remote access, persistence, and lateral movement.
- **First Seen:** Early 2024 (Activity increased through mid-2024)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.004 - Phishing: Voice]
- [T1566.003 - Phishing: Spearphishing Service (Microsoft Teams)]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1218.011 - System Binary Proxy Execution: Rundll32]
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- **[TA0007 - Discovery]**
- [T1087.002 - Account Discovery: Domain Account]
- **[TA0003 - Persistence]**
- [T1105 - Ingress Tool Transfer]
## Functionality
### Core Capabilities
- **Multi-Vector Phishing:** Combines a phone call (vishing) from a spoofed "IT Support" number with a follow-up message on Microsoft Teams to establish trust.
- **RMM Deployment:** Utilizes legitimate Remote Monitoring and Management tools (ScreenConnect, AnyDesk) to bypass traditional antivirus signatures.
- **Credential Harvesting:** Uses fake login portals or prompts victims to execute scripts that exfiltrate session tokens.
### Advanced Features
- **External Access via Teams:** Exploits Microsoft Teams settings that allow external users to message internal employees, bypassing the need for an initial email gateway.
- **EDR Evasion:** Leverages living-off-the-land binaries (LoLBins) and commercial RMMs to blend in with legitimate administrative traffic.
## Indicators of Compromise (IoCs)
*Note: Indicators are based on typical Unit 42 observations for this campaign.*
- **File Hashes (SHA256):**
- `7d9a8b...` (Example ScreenConnect Installer)
- `a4f5c2...` (Example Batch Script for persistence)
- **File Names:**
- `SupportClient.exe`
- `Fix_Issues.bat`
- `IT_Security_Update.exe`
- **Network Indicators:**
- `hxxps[://]microsoft-support[.]us/`
- `hxxps[://]teams-helpdesk[.]com/`
- `instance-name.screenconnect[.]com`
- **Behavioral Indicators:**
- `rundll32.exe` spawning from `Teams.exe`.
- Unexpected external messaging activity in Teams logs.
- Deployment of RMM tools to non-IT personnel.
## Associated Threat Actors
- **Storm-0324** (Related activity)
- **Scattered Spider** (TTP overlap regarding vishing and RMM usage)
## Detection Methods
- **Signature-based:** Detection of unauthorized RMM installers (e.g., specific ScreenConnect instance IDs not owned by the organization).
- **Behavioral detection:**
- Monitoring for Microsoft Teams child processes (e.g., `cmd.exe`, `powershell.exe`).
- Alerting on external domains messaging internal users for the first time.
- **Log Analysis:** Audit Teams "External Access" logs and tenant-to-tenant communications.
## Mitigation Strategies
- **Prevention:** Disable "External Access" in Microsoft Teams or restrict it to a "Whitelist" of trusted domains.
- **Hardening:** Implement FIDO2-based MFA to resist session token theft via phishing proxies.
- **Policy:** Establish a "call-back" verification policy where employees verify IT requests through a known internal directory number.
- **Technical:** Block known RMM ports and unauthorized RMM domains at the firewall/web proxy level.
## Related Tools/Techniques
- **ScreenConnect / ConnectWise Control:** Used for initial remote access.
- **AnyDesk:** Secondary RMM tool for persistence.
- **DarkGate:** Malware often delivered as a second-stage payload following RMM access.
- **SystemBC:** Used for proxying traffic and maintaining C2.