The Trust Default: How Microsoft Teams Became the New Domain Compromise Vector

There is a silent assumption embedded in the architecture of modern enterprise communication. It whispers that a message arriving through an official channel, bearing a professional avatar and a name like "ITProtectionDepartment," must be legitimate. We build firewalls, deploy endpoint detection, and train users to spot phishing emails. Yet, in the first half of 2026, a campaign codenamed Spring Ring demonstrated that the most effective attack surface is not a vulnerability in code, but a default configuration in trust. It did not exploit a zero-day in Microsoft Teams. It exploited the belief that Teams is a safe place.

The Quiet Opening

In late August 2026, Palo Alto Networks' Unit42 disclosed a coordinated attack campaign that had been active from January to April of that year. Dubbed Spring Ring, the campaign attributed to the threat actor Cloaked Ursa—a group with known ties to APT29 and Muddled Libra—targeted over ten organizations and more than 150 employees. The attackers did not begin with a phishing email or a malicious link. They began by registering an .onmicrosoft.com tenant and sending a Teams chat message. The display name was chosen carefully: ITProtectionDepartment. This is the modern equivalent of a wolf in sheep's clothing, but the sheep's clothing is provided by the very platform we trust to conduct business.

The significance of this event extends far beyond the specific victims. It reveals a structural weakness in the default configuration of Microsoft Teams: external access is enabled by default in most M365 tenants. This means any user with a registered tenant—a free and trivial process—can initiate a chat with an employee inside any organization that has not explicitly restricted this capability. The attack surface is not a vulnerability in the codebase; it is a feature. The threat intelligence data paints a clear picture: Teams-based attacks grew by 41% between October 2025 and March 2026, and collaboration tool phishing alerts now account for 42% of all phishing alerts, up from 30% in the preceding four months. The vector is not just viable; it is increasingly preferred.

In my years auditing security architectures, I have often observed that the most devastating breaches do not come from sophisticated exploitation of obscure protocols, but from the quiet, mundane misconfigurations that administrators never think to review. Teams external access is the perfect example. The platform presents a seamless experience, a global phone book of human trust, and the assumption that the person on the other end is who they claim to be. The Spring Ring campaign weaponized this assumption with devastating precision.

The Anatomy of a Two-Wave Assault

The Spring Ring campaign was not a monolithic operation. Unit42 identified two distinct waves, each with its own technical fingerprint and level of sophistication. Campaign A was the initial probe, a more generalized attempt to establish a foothold. The attackers deployed Remote Monitoring and Management (RMM) tools and an obfuscated PowerShell RAT hosted on the domain san-sid.com. They disabled Anti-Malware Scan Interface (AMSI) to avoid detection and performed local enumeration to map the environment. This wave was ultimately blocked by Cortex XDR, Palo Alto's endpoint detection and response platform. It was a signal of intent, a test of the waters.

Campaign B, however, was markedly different. It was a targeted operation, refined by the lessons of the first wave. The attackers hosted files on S3 buckets with names that included the victim's company name and specific usernames, indicating a level of pre-attack reconnaissance that suggests a deliberate selection of high-value targets. The delivery mechanism was not a generic payload but a carefully orchestrated sequence. It began with a Teams chat, transitioned into a vishing call to build rapport, and then guided the victim to install an RMM tool under the guise of IT support. From there, the attack escalated to a headless Edge browser hijack and culminated in a PetitPotam NTLM relay attack against the domain controller.

This is where the story diverges from a simple phishing campaign. The final stage of Campaign B involved a Pass-the-Hash (PtH) technique, identified by the MITRE ATT&CK ID T1550.002, to achieve domain-level privileges. The attack chain—Teams chat → vishing → RMM access → NTLM relay → Pass the Hash → domain controller compromise—is a masterclass in chaining disparate technologies into a single, coherent offensive operation. The attackers did not need to exploit a novel vulnerability in Teams; they needed only to exploit the trust gradient between a chat message and a domain admin. Unit42 MDR successfully prevented the domain takeover, but the fact that the chain reached that stage is a chilling testament to the vulnerability of hybrid identity architectures.

The use of PetitPotam is particularly instructive. This vulnerability, CVE-2021-36942, was patched in August 2021. Its successful use in 2026 indicates that the victim organizations had failed to patch legacy ADCS components, a common failing in hybrid environments where the urgency of patching on-premises infrastructure is often overshadowed by the push to the cloud. The attackers did not choose a zero-day; they chose a known, reliable exploit that still works because of systemic patch management fatigue. This is not a failure of technology; it is a failure of operational discipline.

The Identity Layer as the New Perimeter

For years, the security industry has preached the mantra of "assume breach" and the need to protect the identity layer. The Spring Ring campaign provides a stark validation of this thesis. The attackers did not target endpoints or application vulnerabilities as a primary vector. They targeted identity itself. They did this by compromising the trust that users place in a communication tool. The perimeter has shifted from the network boundary to the user's perception of legitimacy.

The data supports this shift. KnowBe4 reported a 41% increase in Teams-based attacks over six months, while Unit42's Cortex telemetry shows a significant rise in collaboration tool phishing alerts. This is not an anomaly; it is a trend. As email security gateways improve and users become more wary of suspicious links in their inbox, attackers are migrating to channels where the user's guard is lower. Teams, Slack, and other collaboration platforms represent the new frontier of social engineering. The message arrives in the same interface where the user discusses sensitive projects with colleagues. The cognitive dissonance of a message from an external user is minimal, especially when the display name is as innocuous as "ITProtectionDepartment."

This is a form of domain compromise that does not require technical exploitation of a domain name. It is a compromise of the trust domain that the user associates with the platform. The attackers did not need to hack into Active Directory to begin their assault; they needed to hack into the human mind. The technical escalation to NTLM relay and PtH was merely the final step in a process that began with a simple, unrequested chat message.

From my experience in the field, I have seen a consistent pattern: organizations invest heavily in endpoint detection, network segmentation, and security awareness training for email. Yet, they often overlook the collaboration platform as an attack surface. The configuration that allows external users to contact internal staff is viewed as a business enabler, not a risk. The Spring Ring campaign should be a wake-up call. It is not enough to secure the pipes; we must secure the conversations.

A Contrarian View: The Victim's Blind Spot

The conventional response to a campaign like Spring Ring is to prescribe technical controls: disable Teams external access, enforce stricter conditional access policies, and deploy more robust identity threat detection. These are all commendable steps, but they address the symptom, not the root cause. The contrarian truth is that the victims were not merely unlucky; they were architecturally complacent. They embraced a hybrid identity model—one that seamlessly integrates on-premises Active Directory with cloud services—without fully understanding the security implications of that integration.

The reliance on NTLM for authentication, even in a patched environment, is a legacy debt that continues to be a primary target for attackers. Pass-the-Hash attacks are not new; they have been a staple of offensive tradecraft for over a decade. The fact that they still succeed speaks to a stubbornness in enterprise architecture to fully transition to modern authentication protocols like Kerberos with proper delegation controls, or to implement Credential Guard and other mitigations. The attack chain in Spring Ring leveraged the gap between the modern, cloud-native communication layer (Teams) and the legacy, on-premises trust layer (NTLM). This gap is the victim's blind spot.

Furthermore, the human element cannot be understated. The vishing component of the attack was not a random call but a targeted manipulation of the user. The attackers used a professional name and a plausible pretext to establish trust. This is a reflection of a deeper problem: we train users to be skeptical of emails with poor grammar or suspicious URLs, but we do not train them to be skeptical of a voice on the phone or a message in a chat window from a self-proclaimed IT professional. The social contract of the workplace assumes that internal tools are safe. Spring Ring broke that contract, and the victims were caught off-guard because they did not anticipate the violation.

The Takeaway: A Call for Default Security

The Spring Ring campaign is more than a security incident; it is a case study in the ethics of platform design. Microsoft Teams is a powerful collaboration tool, but its default configuration of open external access prioritizes usability and adoption over security. This is a design decision that has profound implications. It shifts the burden of security onto the customer, who may lack the expertise to understand the risk. The platform should not default to a state that is inherently vulnerable to social engineering. It should default to a state that requires explicit user action to enable external communication.

This is not a call to abandon Teams or to retreat to a hermetic existence. It is a call for a new paradigm of default security. The same principle applies to the broader blockchain and Web3 ecosystem that I write about. Decentralization is not an end in itself; it is a means to preserve human autonomy. But autonomy without security is an illusion. The code that governs our digital lives must be designed with the assumption that the user is not an expert, that the environment is hostile, and that trust must be earned, not granted by default.

The attackers in Spring Ring were not sophisticated in their use of technology; they were sophisticated in their understanding of human psychology. They exploited the default trust we place in our communication tools. The lesson is clear: we must fundamentally rethink the defaults. We must build systems where code executes, but ethics sustain. The ethics of security demand that the platform not expose users to attack by default, that the identity layer be treated as the new perimeter, and that the burden of proof lies with the external entity, not the internal user.

Noise fades. Value remains. In the face of this new vector, the value is in resilience. The organizations that emerge stronger from this threat landscape will be those that reject the convenience of default configurations and embrace a deliberate, security-first approach to their digital infrastructure. The silence of a secure system speaks louder than the pumps of a compromised one. The future belongs to those who understand that trust is not a default but a discipline.