Cloaked Ursa

Spring Ring impersonated the help desk over external Teams accounts to relay NTLM at domain controllers

Unit 42 says the crew reached more than 150 employees at ten or more companies without a single software exploit, which puts Teams federation policy and NTLM relay hardening in scope and leaves the endpoint downstream.