Spring Ring: hunt the Teams helpdesk that never hits email

Unit 42 published Spring Ring today, 31 August 2026. The activity in the report is from January through April. This is leftover tradecraft, not a weekend outbreak. If you are hunting it because the write-up is new, you are hunting a gap that has been sitting in Teams since winter. The gap is Chat with anyone plus a voice call that never hits the mail gateway.

They are not phish-mailing IT. A throwaway .onmicrosoft.com tenant named like a helpdesk opens a Teams chat. Then a 10 to 15-minute vishing call. Then Quick Assist or another RMM, or a company-named S3 dropper that SMB-scans and tries to coerce the DC. Chat with anyone is on by default in a lot of tenants. That is how the stranger gets in the same window as your real helpdesk. Print that on a sticky note if you still only hunt .eml files.

How Spring Ring reaches Microsoft Teams

The door is an external 1:1. Teams will warn you. A lot of people click Accept anyway because the display name says help desk, IT assistance, or support staff. The tenant looks almost internal: InternalSystemsDaily, ITProtectionDepartment, MandatoryNetworkMonitoring, CertifiedUpdateNetwork. All .onmicrosoft.com. Some go further and use a first name, patrick or robert or clara, on a desk-sounding subdomain. It is not your tenant. It is a throwaway; they stood up, so the chat looks like work.

If you are the analyst who got that ticket, this is the part that feels unfair. The user talked to IT. The call was in Teams. Email is clean. There is no lure in the quarantine. That is exactly when this campaign wants you to stop looking.

Then they call. A lot of those calls last a few seconds. They are cycling names. The ones that land run 10 to 15 minutes. That is long enough to talk someone through Quick Assist, or through a download whose filename has your company and the victim's name in it. Voice does not land in Proofpoint. It does not get an external banner in the inbox. It happens in the same window where your real IT already lives.

If your users are trained on email and not on Teams, this is why. The mail gateway never sees it.

Two paths after the call

One path is the support-tool path. They walk the user through Quick Assist or through a third-party RMM that the user does not normally run. Once they have the desktop, they look around. Then they pull more. The leftover on this path is the RMM tree after Teams, and later a pull from san-sid.com. I am not going to reconstruct the RAT. You hunt Teams, then Quick Assist or RMM, then that domain. If python never showed up, you still have a case. The call was the case.

The other path is the company-named dropper. During the call, they sent a cloud link that looks like yours. The host is S3. The file is named like an org filter update for that user. It stages under Temp as names like vhlp-*.exe and scnr-*.exe. It can shove an Edge extension on. Then python.exe under C:\ProgramData\IntegrityData\ starts talking 445 inside the network and trying to coerce the DC. Unit 42 calls that PetitPotam. I am not going to reconstruct it. You hunt the EFSRPC and the SMB from python under IntegrityData, after a Teams call.

Both paths start the same. Chat. Voice. Then a tool the user ran because they thought IT asked. If you only hunt the second path, you miss the shops where Quick Assist was enough.

Hunt the chat that became a call

Start with identity, not on the endpoint. External 1:1 in Teams, then audio, from a helpdesk-named .onmicrosoft.com tenant. That is the case opening, even if the call died in 30 seconds. They try more than one person. One quiet miss is still a lead.

Then look at the endpoint in the same window. Quick Assist or an RMM the user does not own, parented by Teams. python.exe under IntegrityData. vhlp- and scnr- junk in Temp. An Edge extension nobody packaged. DNS to san-sid.com. SMB 445 from python.exe under IntegrityData, or EFSRPC to a DC, after that dropper. That is not a print driver. That is the call landing.

Unit 42 watched this across more than 10 companies and more than 150 people. The report is new. The chats are old. If Chat with anyone is still on, and you do not hunt external Teams audio, you are hunting last year's mailbox.

A clean bill is not "we blocked the S3 link." A clean bill is: you can see the chat-to-call, you can see Quick Assist after Teams, you can see the IntegrityData python and the DC coerce attempt, and Chat with anyone is a choice you made on purpose. Anything short of that is still the January ticket, published in August. Same shape as last week's closed ticket that came back. Different product. The voice never hit the gateway.

Spring Ring hunts

Hunt Spring Ring in KQL

CloudAppEvents
| where Timestamp >= datetime(2026-01-01)
| where Application has "Teams"
| where ActionType has_any ("ChatCreated", "CallStarted", "CallAccepted")
| where AccountType != "Regular" or tostring(RawEventData) has "External"
| project Timestamp, AccountObjectId, AccountDisplayName, ActionType, AccountType, RawEventData

DeviceProcessEvents
| where Timestamp >= datetime(2026-01-01)
| where (FileName in~ ("ms-quick-assist.exe", "quickassist.exe") and InitiatingProcessFileName has "Teams")
   or (FileName =~ "python.exe" and FolderPath has @"C:\ProgramData\IntegrityData")
   or FileName matches regex "(?i)^(vhlp-|scnr-)"
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256

DeviceNetworkEvents
| where Timestamp >= datetime(2026-01-01)
| where RemoteUrl has "san-sid.com"
   or (RemotePort == 445 and InitiatingProcessFileName =~ "python.exe" and InitiatingProcessFolderPath has @"IntegrityData")
   or AdditionalFields has "EFSRPC"
| project Timestamp, DeviceName, FileName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine

union DeviceFileEvents, DeviceNetworkEvents
| where Timestamp >= datetime(2026-01-01)
| where FileName has "org-filters-update"
   or RemoteUrl has "org-filters-update"
   or RemoteUrl has "s3.us-west-2.amazonaws.com"
| project Timestamp, DeviceName, FileName, FolderPath, RemoteUrl, InitiatingProcessFileName, SHA256

Hunt Spring Ring in Falcon CQL

#event_simpleName=ProcessRollup2 timestamp:>=2026-01-01
| ParentBaseFileName=/(?i)(teams|ms-teams)/
| FileName=/(?i)(ms-quick-assist|quickassist|anydesk|splashtop|screenconnect)/

#event_simpleName=DnsRequest timestamp:>=2026-01-01
| DomainName=/(?i)san-sid\.com/

#event_simpleName=NetworkConnectIP4 timestamp:>=2026-01-01
| RemotePort=445
| ContextBaseFileName=/python\.exe/i
| ContextImageFileName=/IntegrityData/i

#event_simpleName=ProcessRollup2 timestamp:>=2026-01-01
| FileName=/(?i)msedge/
| CommandLine=/(?i)(--load-extension|--load-and-launch-app)/

Hunt Spring Ring in Splunk

earliest=01/01/2026:00:00:00
(index=o365 OR sourcetype=*o365*)
  ((ChatCreated OR CallStarted) AND (External OR Federated))
OR (index=windows EventCode=4688)
  ("ms-quick-assist" OR (python.exe AND IntegrityData))
OR (index=sysmon EventCode=3)
  (san-sid.com OR EFSRPC OR (DestPort=445 AND python.exe AND IntegrityData))

Hunt Spring Ring in Kibana

@timestamp >= "2026-01-01" AND (
  (process.name:ms-quick-assist.exe AND process.parent.name:*teams*)
  OR dns.question.name:*san-sid.com*
  OR (file.name:(vhlp-*.exe OR scnr-*.exe) AND file.path:*Temp*)
)

Sources

Unit 42, Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams, 31 August 2026. Activity January through April 2026.

What This Means for Your Team

If you only hunt mail, you will miss this. A helpdesk-named .onmicrosoft.com tenant plus a Teams audio call is the case, even when print and email look fine. Chat with anyone is the door. Hunt the chat that became a call. Do not wait for a weekend outbreak. The report is new. The tradecraft is leftover.

Strengthening Your Defenses with Inception Protection

At Inception Security, Inception Protection is our MDR for Microsoft environments. We use the Defender, Sentinel, Conditional Access, and Azure licenses you already have. We hunt external Teams 1:1s that turn into calls, Quick Assist after a helpdesk chat, and Identity use that does not look like the user.

Assessing Your Security Posture with a Free Inception Foresight M365 Assessment

Want to see where your environment stands? Grab our free Inception Foresight M365 Assessment. No strings. If this is useful, follow Inception Security on LinkedIn and @inceptionsec on X.