[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwHKmVklNRyYyZ3ahyfq3iZ8-9A6lqXL8j-Zsobi0Egc":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"af74f689-4612-4c62-89fe-877e2ba6c6d0","Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users","threat-gang-springs-vishing-attacks-on-microsoft-teams-users-e7f4b9","The \"Spring Ring\" operation aims to compromise users of the collaboration suite to remotely access their sessions, spread malware, and even take over infrastructure.","A threat actor known as 'Spring Ring' is conducting a sophisticated operation targeting Microsoft Teams users. The campaign employs vishing (voice phishing) tactics to trick users into granting unauthorized access to their Teams sessions. The ultimate goals include spreading malware, gaining remote access, and potentially compromising entire infrastructures.","Threat actor 'Spring Ring' targets Microsoft Teams users with vishing attacks.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fthreat-gang-springs-vishing-attacks-microsoft-teams-users","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt3c8192b6490626c0\u002F6a981a98644fc5665f78add9\u002Fphone-Brian_Jackson-Alamy.jpg?width=720&quality=80&disable=upscale","2026-09-02T16:51:21+00:00","2026-09-02T18:00:08.392951+00:00",7,[17,20],{"name":18,"type":19},"Spring Ring","threat_actor",{"name":21,"type":22},"Microsoft Teams","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":49,"vendors":131},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":109,"name":110,"problem":111,"products":112},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[113,120,125],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":117,"url":118,"description":119},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":121,"product_name":122,"url":123,"description":124},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":127,"url":129,"description":130},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[132],{"slug":72,"name":73,"logo_path":74,"roles":133},[134],"affected",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":151},"vishing-attacks-exploit-human-trust-to-hijack-microsoft-teams-sessions","Vishing Attacks Exploit Human Trust to Hijack Microsoft Teams Sessions","The 'Spring Ring' threat actor is exploiting human psychology rather than technical vulnerabilities, using voice phishing (vishing) to manipulate Microsoft Teams users into voluntarily granting unauthorized access to their sessions. This attack succeeds because users are not trained to recognize social engineering delivered via voice calls, especially when the attacker impersonates trusted entities like IT support. Once access is granted, attackers can deploy malware and pivot laterally across entire organizational infrastructures. This campaign highlights that even robust technical controls can be bypassed when employees are not equipped to identify and respond to social engineering threats.",[140,141,142,143,144,145,146,147,148,149,150],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-50 – Security Awareness Training","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST IA-2 – Identification and Authentication (MFA)","NIST AT-2 – Literacy Training and Awareness","MITRE ATT&CK T1566.004 – Phishing: Voice Phishing (Vishing)","ISO\u002FIEC 27001 – A.7.2.2 Information Security Awareness and Training","GDPR Article 32 – Security of Processing",{}]