Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

    Tuesday, September 1, 2026 In: Threat Research Print

    Date: 09/01/2026

    Severity: Critical

    Summary

    Between January and April 2026, researchers uncovered a social engineering campaign called Spring Ring that impersonated IT help desk staff through external Microsoft Teams accounts. The campaign targeted more than 150 employees across at least 10 organizations in multiple industries using voice phishing (vishing) techniques. Attackers attempted to convince victims to install remote monitoring and management (RMM) tools or custom malware, with some attacks escalating into NTLM relay attacks targeting domain controllers. The two observed campaigns demonstrate how threat actors are increasingly weaponizing communication platforms to exploit identity and deliver malicious payloads.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    https://san-sid.com/owners

    IP Address 

    193.32.248.251

    193.138.7.142

    185.65.134.209

    178.130.47.46

    5.181.3.106

    2.56.172.214

    185.234.67.53

    45.8.157.185

    80.66.72.215

    136.0.20.6

    185.213.155.226

    185.155.99.161

    92.118.232.131

    45.182.189.80

    185.65.133.51

    45.33.22.47

    Hash 

    24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b

    Email Address

    helpcenter@ithelpcenter365.onmicrosoft.com

    helpdesk@itprotectiondepartment.onmicrosoft.com

    helpdesk@newsystemmaintenance.onmicrosoft.com

    helpdesk@officedesk365.onmicrosoft.com

    helpdesk@officesecures.onmicrosoft.com

    helpdesk@tbcsschid.onmicrosoft.com

    internal@internalusahelpdeskIT.onmicrosoft.com

    it_assistance@teams0137.onmicrosoft.com

    it@infrastructurefirewall.onmicrosoft.com

    itadmin@mandatorynetworkmonitoring.onmicrosoft.com

    itassistant@bilelonellc.onmicrosoft.com

    ithelp@certifiednetworksec.onmicrosoft.com

    ithelp@internalsystemsdaily.onmicrosoft.com

    ithelp@itprotectiondepartment.onmicrosoft.com

    ithelp@mandatorynetworkmonitoring.onmicrosoft.com

    ithelpdesk@certifiedupdatenetwork.onmicrosoft.com

    support@bilelonellc.onmicrosoft.com

    andreas[..]@idigitalserviceoperation.onmicrosoft.com

    andrew[..]@hapsinfrastructureops.onmicrosoft.com

    brandon[..]@devsitoperationhub.onmicrosoft.com

    brian[..]@appssupportsys.onmicrosoft.com

    christopher[..]@adevpsitplatformops.onmicrosoft.com

    christopher[..]@itplatformops.onmicrosoft.com

    christopher[..]@helpaphelpitinfraops.onmicrosoft.com

    clara[..]@systemsupportoperations.onmicrosoft.com

    daniel[..]@opsnetsupportit.onmicrosoft.com

    daniel[..]@apsitsupporthub.onmicrosoft.com

    emily[..]@apsitechsupportdesk.onmicrosoft.com

    eric[..]@appopshelp.onmicrosoft.com

    henrik[..]@enterpriseoperationsflo.onmicrosoft.com

    james[..]@helpitsupportcore.onmicrosoft.com

    james[..]@itcoretechhelp.onmicrosoft.com

    jonathan[..]@itservicedesk.onmicrosoft.com

    justin[..]@techopshelpsupp.onmicrosoft.com

    kevin[..]@itopsupportdesk.onmicrosoft.com

    kevin[..]@netopsdeskhelp.onmicrosoft.com

    leon[..]@netcorevdapp.onmicrosoft.com

    lucas[..]@applicationoperationsunit.onmicrosoft.com

    martin[..]@syslanevdapp.onmicrosoft.com

    matthew[..]@supportopsupp.onmicrosoft.com

    michael[..]@appdeploymentservices.onmicrosoft.com

    michael[..]@infratechopsdesk.onmicrosoft.com

    michael[..]@itopsdeskhelp.onmicrosoft.com

    patrick[..]@infrastructureopsdesk.onmicrosoft.com

    rachel[..]@ioseccloudsupport.onmicrosoft.com

    rebecca[..]@infrastructureopsservice.onmicrosoft.com

    robert[..]@systemdeploymentcenter.onmicrosoft.com

    ryan[..]@apstechopsdeskdev.onmicrosoft.com

    ryan[..]@helpssupportcloudops.onmicrosoft.com

    ryan[..]@seqhelpitsuppnetops.onmicrosoft.com

    sarah[..]@secinfrahelpdesk.onmicrosoft.com

    sarah[..]@apsscloudopsdesk.onmicrosoft.com

    sarah[..]@helpitdevsupportops.onmicrosoft.com

    sarah[..]@itdevsupportops.onmicrosoft.com

    scott[..]@cloudinfrastr.onmicrosoft.com

    steven[..]@ittechnologyopsitdesk.onmicrosoft.com

    thomas[..]@networkoperationsec.onmicrosoft.com

    thomas[..]@seqapsitsupportops.onmicrosoft.com

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "https://san-sid.com/owners" or url like "https://san-sid.com/owners" or siteurl like "https://san-sid.com/owners"

    Detection Query 2 :

    dstipaddress IN ("193.32.248.251","185.234.67.53","185.213.155.226","5.181.3.106","80.66.72.215","45.182.189.80","185.65.134.209","2.56.172.214","193.138.7.142","178.130.47.46","185.155.99.161","185.65.133.51","45.8.157.185","45.33.22.47","136.0.20.6","92.118.232.131") or srcipaddress IN ("193.32.248.251","185.234.67.53","185.213.155.226","5.181.3.106","80.66.72.215","45.182.189.80","185.65.134.209","2.56.172.214","193.138.7.142","178.130.47.46","185.155.99.161","185.65.133.51","45.8.157.185","45.33.22.47","136.0.20.6","92.118.232.131")

    Detection Query 3 :

    sha256hash IN ("24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b")

    Detection Query 4 :

    sender IN ("helpcenter@ithelpcenter365.onmicrosoft.com","helpdesk@itprotectiondepartment.onmicrosoft.com","helpdesk@newsystemmaintenance.onmicrosoft.com","helpdesk@officedesk365.onmicrosoft.com","helpdesk@officesecures.onmicrosoft.com","helpdesk@tbcsschid.onmicrosoft.com","internal@internalusahelpdeskIT.onmicrosoft.com","it_assistance@teams0137.onmicrosoft.com","it@infrastructurefirewall.onmicrosoft.com","itadmin@mandatorynetworkmonitoring.onmicrosoft.com","itassistant@bilelonellc.onmicrosoft.com","ithelp@certifiednetworksec.onmicrosoft.com","ithelp@internalsystemsdaily.onmicrosoft.com","ithelp@itprotectiondepartment.onmicrosoft.com","ithelp@mandatorynetworkmonitoring.onmicrosoft.com","ithelpdesk@certifiedupdatenetwork.onmicrosoft.com","support@bilelonellc.onmicrosoft.com","andreas%@idigitalserviceoperation.onmicrosoft.com","andrew%@hapsinfrastructureops.onmicrosoft.com","brandon%@devsitoperationhub.onmicrosoft.com","brian%@appssupportsys.onmicrosoft.com","christopher%@adevpsitplatformops.onmicrosoft.com","christopher%@itplatformops.onmicrosoft.com","christopher%@helpaphelpitinfraops.onmicrosoft.com","clara%@systemsupportoperations.onmicrosoft.com","daniel%@opsnetsupportit.onmicrosoft.com","daniel%@apsitsupporthub.onmicrosoft.com","emily%@apsitechsupportdesk.onmicrosoft.com","eric%@appopshelp.onmicrosoft.com","henrik%@enterpriseoperationsflo.onmicrosoft.com","james%@helpitsupportcore.onmicrosoft.com","james%@itcoretechhelp.onmicrosoft.com","jonathan%@itservicedesk.onmicrosoft.com","justin%@techopshelpsupp.onmicrosoft.com","kevin%@itopsupportdesk.onmicrosoft.com","kevin%@netopsdeskhelp.onmicrosoft.com","leon%@netcorevdapp.onmicrosoft.com","lucas%@applicationoperationsunit.onmicrosoft.com","martin%@syslanevdapp.onmicrosoft.com","matthew%@supportopsupp.onmicrosoft.com","michael%@appdeploymentservices.onmicrosoft.com","michael%@infratechopsdesk.onmicrosoft.com","michael%@itopsdeskhelp.onmicrosoft.com","patrick%@infrastructureopsdesk.onmicrosoft.com","rachel%@ioseccloudsupport.onmicrosoft.com","rebecca%@infrastructureopsservice.onmicrosoft.com","robert%@systemdeploymentcenter.onmicrosoft.com","ryan%@apstechopsdeskdev.onmicrosoft.com","ryan%@helpssupportcloudops.onmicrosoft.com","ryan%@seqhelpitsuppnetops.onmicrosoft.com","sarah%@secinfrahelpdesk.onmicrosoft.com","sarah%@apsscloudopsdesk.onmicrosoft.com","sarah%@helpitdevsupportops.onmicrosoft.com","sarah%@itdevsupportops.onmicrosoft.com","scott%@cloudinfrastr.onmicrosoft.com","steven%@ittechnologyopsitdesk.onmicrosoft.com","thomas%@networkoperationsec.onmicrosoft.com","thomas%@seqapsitsupportops.onmicrosoft.com")

    Detection Query 5 :

    recipient IN ("helpcenter@ithelpcenter365.onmicrosoft.com","helpdesk@itprotectiondepartment.onmicrosoft.com","helpdesk@newsystemmaintenance.onmicrosoft.com","helpdesk@officedesk365.onmicrosoft.com","helpdesk@officesecures.onmicrosoft.com","helpdesk@tbcsschid.onmicrosoft.com","internal@internalusahelpdeskIT.onmicrosoft.com","it_assistance@teams0137.onmicrosoft.com","it@infrastructurefirewall.onmicrosoft.com","itadmin@mandatorynetworkmonitoring.onmicrosoft.com","itassistant@bilelonellc.onmicrosoft.com","ithelp@certifiednetworksec.onmicrosoft.com","ithelp@internalsystemsdaily.onmicrosoft.com","ithelp@itprotectiondepartment.onmicrosoft.com","ithelp@mandatorynetworkmonitoring.onmicrosoft.com","ithelpdesk@certifiedupdatenetwork.onmicrosoft.com","support@bilelonellc.onmicrosoft.com","andreas%@idigitalserviceoperation.onmicrosoft.com","andrew%@hapsinfrastructureops.onmicrosoft.com","brandon%@devsitoperationhub.onmicrosoft.com","brian%@appssupportsys.onmicrosoft.com","christopher%@adevpsitplatformops.onmicrosoft.com","christopher%@itplatformops.onmicrosoft.com","christopher%@helpaphelpitinfraops.onmicrosoft.com","clara%@systemsupportoperations.onmicrosoft.com","daniel%@opsnetsupportit.onmicrosoft.com","daniel%@apsitsupporthub.onmicrosoft.com","emily%@apsitechsupportdesk.onmicrosoft.com","eric%@appopshelp.onmicrosoft.com","henrik%@enterpriseoperationsflo.onmicrosoft.com","james%@helpitsupportcore.onmicrosoft.com","james%@itcoretechhelp.onmicrosoft.com","jonathan%@itservicedesk.onmicrosoft.com","justin%@techopshelpsupp.onmicrosoft.com","kevin%@itopsupportdesk.onmicrosoft.com","kevin%@netopsdeskhelp.onmicrosoft.com","leon%@netcorevdapp.onmicrosoft.com","lucas%@applicationoperationsunit.onmicrosoft.com","martin%@syslanevdapp.onmicrosoft.com","matthew%@supportopsupp.onmicrosoft.com","michael%@appdeploymentservices.onmicrosoft.com","michael%@infratechopsdesk.onmicrosoft.com","michael%@itopsdeskhelp.onmicrosoft.com","patrick%@infrastructureopsdesk.onmicrosoft.com","rachel%@ioseccloudsupport.onmicrosoft.com","rebecca%@infrastructureopsservice.onmicrosoft.com","robert%@systemdeploymentcenter.onmicrosoft.com","ryan%@apstechopsdeskdev.onmicrosoft.com","ryan%@helpssupportcloudops.onmicrosoft.com","ryan%@seqhelpitsuppnetops.onmicrosoft.com","sarah%@secinfrahelpdesk.onmicrosoft.com","sarah%@apsscloudopsdesk.onmicrosoft.com","sarah%@helpitdevsupportops.onmicrosoft.com","sarah%@itdevsupportops.onmicrosoft.com","scott%@cloudinfrastr.onmicrosoft.com","steven%@ittechnologyopsitdesk.onmicrosoft.com","thomas%@networkoperationsec.onmicrosoft.com","thomas%@seqapsitsupportops.onmicrosoft.com")

    Detection Query 6 :

    From IN ("helpcenter@ithelpcenter365.onmicrosoft.com","helpdesk@itprotectiondepartment.onmicrosoft.com","helpdesk@newsystemmaintenance.onmicrosoft.com","helpdesk@officedesk365.onmicrosoft.com","helpdesk@officesecures.onmicrosoft.com","helpdesk@tbcsschid.onmicrosoft.com","internal@internalusahelpdeskIT.onmicrosoft.com","it_assistance@teams0137.onmicrosoft.com","it@infrastructurefirewall.onmicrosoft.com","itadmin@mandatorynetworkmonitoring.onmicrosoft.com","itassistant@bilelonellc.onmicrosoft.com","ithelp@certifiednetworksec.onmicrosoft.com","ithelp@internalsystemsdaily.onmicrosoft.com","ithelp@itprotectiondepartment.onmicrosoft.com","ithelp@mandatorynetworkmonitoring.onmicrosoft.com","ithelpdesk@certifiedupdatenetwork.onmicrosoft.com","support@bilelonellc.onmicrosoft.com","andreas%@idigitalserviceoperation.onmicrosoft.com","andrew%@hapsinfrastructureops.onmicrosoft.com","brandon%@devsitoperationhub.onmicrosoft.com","brian%@appssupportsys.onmicrosoft.com","christopher%@adevpsitplatformops.onmicrosoft.com","christopher%@itplatformops.onmicrosoft.com","christopher%@helpaphelpitinfraops.onmicrosoft.com","clara%@systemsupportoperations.onmicrosoft.com","daniel%@opsnetsupportit.onmicrosoft.com","daniel%@apsitsupporthub.onmicrosoft.com","emily%@apsitechsupportdesk.onmicrosoft.com","eric%@appopshelp.onmicrosoft.com","henrik%@enterpriseoperationsflo.onmicrosoft.com","james%@helpitsupportcore.onmicrosoft.com","james%@itcoretechhelp.onmicrosoft.com","jonathan%@itservicedesk.onmicrosoft.com","justin%@techopshelpsupp.onmicrosoft.com","kevin%@itopsupportdesk.onmicrosoft.com","kevin%@netopsdeskhelp.onmicrosoft.com","leon%@netcorevdapp.onmicrosoft.com","lucas%@applicationoperationsunit.onmicrosoft.com","martin%@syslanevdapp.onmicrosoft.com","matthew%@supportopsupp.onmicrosoft.com","michael%@appdeploymentservices.onmicrosoft.com","michael%@infratechopsdesk.onmicrosoft.com","michael%@itopsdeskhelp.onmicrosoft.com","patrick%@infrastructureopsdesk.onmicrosoft.com","rachel%@ioseccloudsupport.onmicrosoft.com","rebecca%@infrastructureopsservice.onmicrosoft.com","robert%@systemdeploymentcenter.onmicrosoft.com","ryan%@apstechopsdeskdev.onmicrosoft.com","ryan%@helpssupportcloudops.onmicrosoft.com","ryan%@seqhelpitsuppnetops.onmicrosoft.com","sarah%@secinfrahelpdesk.onmicrosoft.com","sarah%@apsscloudopsdesk.onmicrosoft.com","sarah%@helpitdevsupportops.onmicrosoft.com","sarah%@itdevsupportops.onmicrosoft.com","scott%@cloudinfrastr.onmicrosoft.com","steven%@ittechnologyopsitdesk.onmicrosoft.com","thomas%@networkoperationsec.onmicrosoft.com","thomas%@seqapsitsupportops.onmicrosoft.com")

    Reference:    

    https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/                                     


    Tags

    MalwarePhishingVishingSocial EngineeringInformation TechnologyMicrosoftRMMCommunications

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.