The 42% figure is the one that should stop you mid-scroll. Unit42 Cortex telemetry, covering the period of the Spring Ring campaign, shows that collaboration-tool phishing alerts now account for 42% of all phishing alerts, up from 30% in the preceding four months. This is not a gradual drift. This is a structural shift in the threat landscape, and it has a name: Microsoft Teams external access.
For the past decade, the enterprise perimeter has been dissolving. The firewall is dead, the VPN is a legacy artifact, and the identity layer is the new boundary. But the Spring Ring campaign, disclosed by Palo Alto Networks Unit42 on August 31, 2026, demonstrates that the identity layer itself has a blind spot—one that is enabled by default in most Microsoft 365 tenants. The attack chain is not novel in its components, but it is devastating in its orchestration: Teams chat → vishing → RMM access → NTLM relay → Pass the Hash → domain-level compromise.
This is not a story about a software vulnerability. This is a story about a trust architecture that was never designed for adversarial tenants.
The Campaign: A Two-Wave Assault
Spring Ring, active from January to April 2026 and attributed to Cloaked Ursa (APT29 / Muddled Libra), targeted over 10 organizations and more than 150 employees. The attackers registered .onmicrosoft.com tenants and used professional display names—ITProtectionDepartment, Help Desk Support—to impersonate IT help desks. They initiated unsolicited chats and voice calls, leveraging the inherent trust users place in internal communication tools.
Campaign A was a broad sweep. The attackers deployed RMM tools and an obfuscated PowerShell RAT hosted on san-sid.com, disabled AMSI, and performed local enumeration. It was blocked by Cortex XDR during execution. Campaign B was more surgical. It used S3-hosted files named after victim companies and usernames, established persistence mechanisms, and escalated through a headless Edge browser hijack to a PetitPotam NTLM relay attack against domain controllers. Unit42 MDR blocked the domain takeover attempt.
The key takeaway from the two campaigns is not the technical sophistication—it is the operational patience. The attackers were not exploiting zero-days. They were exploiting default configurations and human psychology.
The Trust Deficit in Multi-Tenant Architecture
Let me be precise about the structural flaw. Teams external access is enabled by default in most M365 tenants. External users—non-organization-managed MS Teams accounts—can contact users within an organization. This is a product decision that prioritizes collaboration frictionlessness over security boundary integrity. The result is a cross-tenant attack surface that requires no software vulnerability, only a registered tenant and a convincing voice.
From my experience auditing smart contracts during the 2017 ICO boom, I learned that the most dangerous vulnerabilities are not the complex reentrancy attacks—they are the simple, unchecked assumptions in the code. The same principle applies here. The assumption is that external communication is benign until proven otherwise. The reality is that in a multi-tenant SaaS architecture, every external tenant is a potential adversary.
The attack chain exploits a trust gap between the modern collaboration layer (Teams) and the legacy protocol layer (NTLM). PetitPotam (CVE-2021-36942) was patched in August 2021. Yet it remains a viable escalation vector in 2026. This indicates that many organizations have not disabled NTLM, have not patched ADCS components, and have not implemented a zero-trust identity architecture. The attack surface is not just Teams—it is the entire hybrid identity stack.
The Liquidity of Trust: A Macro View
As a macro watcher, I see a parallel between this attack campaign and the liquidity cycles in digital asset markets. In both cases, the risk is not in the individual components but in the systemic interconnections. Just as a stablecoin depeg can cascade through DeFi protocols, a single Teams external access point can cascade through an enterprise identity infrastructure.
The 41% increase in Teams-based attacks from October 2025 to March 2026 (KnowBe4) is not an anomaly. It is a trend. Attackers are migrating to channels where user trust is highest and defense visibility is lowest. Email has been hardened through years of security awareness training and gateway filtering. Teams has not received the same scrutiny. The result is a channel migration—attackers follow the path of least resistance.
Microsoft's own security blog from April 18, 2026, describes a cross-tenant help desk impersonation playbook that matches the Spring Ring pattern: Teams impersonation leading to Quick Assist sessions, WinRM lateral movement, and data exfiltration via Rclone. This is not a one-off. This is a playbook.
The Contrarian Angle: This Is Not a Microsoft Problem
The conventional narrative will frame this as a Microsoft security failure. That is incomplete. The deeper issue is that the enterprise security architecture has not evolved to match the collaboration architecture. Organizations have adopted Teams, SharePoint, and OneDrive without re-evaluating their identity trust boundaries. They have layered EDR and MDR solutions on top of a legacy AD/NTLM infrastructure, creating a patchwork of controls that can be bypassed by a well-orchestrated social engineering attack.
The contrarian view is that the attack surface is not Teams—it is the organizational failure to implement identity hygiene. The attackers did not need a zero-day. They needed a default configuration and a user who trusted a help desk call. The solution is not to disable Teams external access—it is to implement a comprehensive identity threat detection and response (ITDR) strategy that treats every external interaction as a potential compromise vector.
This is analogous to the DeFi liquidity stress testing I conducted in 2020. When UST's algorithmic peg weakened, my team exited positions 48 hours before the crash. We did not predict the wave; we engineered the hull. The same principle applies to enterprise security: you cannot predict which attack vector will be exploited, but you can engineer your identity infrastructure to withstand the pressure.
The Takeaway: Engineering the Hull
The Spring Ring campaign is a wake-up call for every organization running Microsoft 365. The default-open external access in Teams is a structural vulnerability that requires immediate remediation. But the deeper lesson is about systemic risk. The attack chain—Teams chat to domain compromise—is a reminder that security is not a product feature; it is an architectural principle.
Organizations need to treat their identity infrastructure with the same rigor as their financial infrastructure. This means disabling NTLM, implementing conditional access policies, restricting Teams external access to authorized domains, and deploying ITDR solutions that monitor for anomalous authentication patterns. It also means training employees to question unsolicited help desk contacts—a cultural shift that is as important as any technical control.
We do not predict the wave; we engineer the hull. The Spring Ring campaign is the wave. The question is whether your organization's hull is ready for the next one. The 42% figure is not a statistic—it is a warning. The collaboration layer is now the primary attack surface, and the default configuration is not your friend. Audit your Teams external access settings today. The attackers are already inside the perimeter—they are just waiting for you to let them in.