Spring Ring in Microsoft Teams

Spring Ring in Microsoft Teams, it is the name given to a cybersecurity campaign that uses voice phishing (vishing) through Microsoft Teams. Attackers impersonate IT support staff, contact employees via Teams chat and calls, and try to convince them to install remote-access tools or malware.

How it works

• Attackers create external Microsoft 365/Teams accounts with names that appear legitimate, such as "Help Desk" or "IT Support."
• They start a Teams chat and then place a voice call to the target.
• During the call, they persuade the user to run Quick Assist, install remote management software, or download files.
• Once access is granted, they attempt to take control of the device and deploy malware.

Why it matters for Teams admins

As a Senior Systems Administrator, you should be aware that these attacks leverage Teams External Access/Federation and user trust rather than exploiting a Teams vulnerability. Microsoft Teams itself is not compromised in this scenario.

Recommended protections

• Restrict or review Teams External Access settings.
• Train users to verify unexpected IT support calls.
• Require IT staff to use documented support channels.
• Monitor for unusual Quick Assist or remote management tool usage.
• Use Microsoft Defender and identity protection controls where available.

User Awareness Checklist: Defending Against the "Spring Ring" Teams Vishing Attack

Help employees recognize and respond to fraudulent Microsoft Teams messages and calls from individuals posing as IT support. The Spring Ring campaign targeted users through Teams chats and voice calls, attempting to gain remote access and deploy malware.

Before You Trust a Teams Message or Call

☐ Verify whether the caller is an actual member of your organization's IT team.

☐ Look for the "External" label in Teams chats and calls.

☐ Be suspicious of unsolicited messages claiming there is an urgent security issue.

☐ Question unexpected requests involving your computer, account, password, or MFA.

☐ Do not assume someone is legitimate because their display name says "Help Desk," "IT Support," or similar. Attackers have used these names to appear trustworthy.

---

During a Teams Chat or Call

☐ Stop and verify the request through an approved support channel.

☐ Ask for a ticket number or reference to an existing IT request.

☐ Do not feel pressured by urgent language such as:

• "Your account is compromised."
• "Your device is infected."
• "You must act immediately."
• "Security monitoring detected suspicious activity."

☐ Be cautious if the caller asks you to bypass normal procedures.

☐ Hang up if you feel uncomfortable and contact IT directly using known contact information.

---

Red Flags to Watch For

☐ Unsolicited Teams calls from external users.

☐ Requests to launch Quick Assist or another remote support tool without an existing support case.

☐ Requests to install software or browser extensions.

☐ Instructions to run PowerShell, Command Prompt, or scripts.

☐ Requests to visit unfamiliar websites or download files.

☐ Calls that escalate quickly from chat to remote-control requests. Spring Ring operators commonly attempted to gain remote access through Quick Assist or remote management tools.

---

Never Do These Things

☐ Never share passwords.

☐ Never share MFA approval codes or authentication tokens.

☐ Never approve MFA prompts you did not initiate.

☐ Never grant remote access to someone whose identity you have not verified.

☐ Never download software from links provided during an unsolicited Teams interaction.

---

If You Think You Have Been Targeted

☐ End the Teams call immediately.

☐ Disconnect from the network if instructed by your security team.

☐ Report the incident to IT Security or the Help Desk.

☐ Take screenshots of the chat or caller information if possible.

☐ Preserve any downloaded files and do not delete evidence unless directed by security personnel.

☐ Change passwords if you shared credentials.

☐ Report any unexpected MFA prompts.

---

Quick Employee Rule

If someone contacts you unexpectedly through Teams and asks for remote access, software installation, credentials, or MFA approval, stop, verify independently, and report it. Spring Ring relies on social engineering and trust rather than a technical vulnerability in Microsoft Teams.

Security Team Recommendations

• Review Teams External Access policies.
• Educate users to verify all unsolicited IT support requests.
• Monitor Quick Assist and remote management tool usage.
• Encourage reporting of suspicious Teams calls immediately.
• Periodically conduct phishing and vishing awareness exercises.