Identity Is the New Perimeter
The message landed via Microsoft Teams from an account styled after the corporate IT help desk, and the target handled it like any routine ticket. Seconds later, an audio call followed. The engineer on the line was polite, methodical, and needed only three minutes of remote desktop access to resolve a synchronization error on the user's mailbox. Every detail matched the cadence of a regular workday. The account was external, spawned inside an attacker-controlled tenant engineered to mirror the victim’s corporate naming convention. No zero-day vulnerability was involved; the exploit took advantage of human deference to internal authority.
Inside the Spring Ring Campaign
Palo Alto Networks Unit 42 tracked this exact voice-phishing playbook across more than 150 employees at over 10 enterprises between January and April 2026, driven by 26 distinct attacker identities. The chat was merely the opening handshake; the victim's own hands and administrative permissions served as the deployment engine.
Unit 42 reconstructed two distinct intrusion paths:
Vector 1: The Native Utility Pivot. The attacker guided the employee to launch a trusted remote assistance tool—Windows Quick Assist or standard enterprise RMM software—and hand over desktop control. Once inside the live session, the intruder ran reconnaissance commands to map Active Directory group memberships before attempting to stage an obfuscated PowerShell trojan from an external server. In these instances, traditional endpoint detection functioned as intended, killing the payload at execution.
Vector 2: The Infrastructure Escalation. The attacker directed the target to a cloud link hosting a tailored executable branded with the victim’s employer and username. Executing it quietly spawned a headless browser session and sideloaded a rogue extension. The attacker then pivoted laterally across the internal subnet via SMB scanning, captured NTLM hashes, and launched a PetitPotam attack to coerce authentication from the domain controller back to a rogue relay. Managed detection and response teams intercepted the escalation sequence before domain dominance could be secured.
The Illusion of Routine Traffic
Traditional security architectures look for malicious software; modern identity campaigns look like everyday business. This distinction explains the central metric from CrowdStrike’s 2026 Global Threat Report: 82% of observed enterprise detections in 2025 were malware-free, relying entirely on valid credentials, trusted identity flows, and native administration tooling.
Neither Spring Ring vector required an exploit or specialized malware to gain an initial foothold. The intrusion looked like normal business activity because, until the lateral pivot, it ran across approved administrative channels. Endpoint protection guards the physical host, and the SIEM records audit logs. Neither platform is built to determine whether legitimate credentials and screen-sharing tools are being operated by an authorized IT technician or an adversary holding the line.
That blind spot defines the role of Identity Threat Detection and Response (ITDR). Where Identity and Access Management (IAM) dictates who receives access, ITDR analyzes what that identity does once inside—correlating anomalous authentication context, unexpected privilege creep, and unusual lateral hops that slip right past perimeter controls.
The Controls That Change the Calculus
Neutralizing campaigns like Spring Ring requires hardening three specific failure points:
Bidirectional Support Verification: The critical breakdown in Spring Ring was not a help desk failing to verify a caller; it was an employee trusting an unverified internal call. Defenses must enforce an out-of-band verification protocol: require employees to hang up and confirm any inbound IT contact via an established internal ticketing portal or official corporate directory before launching screen shares or running attachments.
Phishing-Resistant Authentication: Legacy MFA (SMS codes and push notifications) crumbles against Adversary-in-the-Middle (AitM) proxy attacks that intercept session tokens. Deploying hardware-backed FIDO2 keys and cryptographic passkeys binds the authentication handshake directly to the verified domain, eliminating credential interception at the login tier.
Behavioral ITDR: Deploying detection telemetry directly inside the identity tier provides real-time detection of privilege escalation, anomalous Service Principal Name queries, and credential abuse before adversaries can pivot toward critical domain assets.
Sources
Palo Alto Networks, Unit 42. "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams." https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/
CrowdStrike. "CrowdStrike 2026 Global Threat Report: Evasive Adversary Wields AI." https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/
Gartner. "Identity Threat Detection and Response (ITDR) Reviews and Ratings." https://www.gartner.com/reviews/market/identity-threat-detection-and-response-itdr
Disclaimer
This article is provided for general informational and educational purposes only and does not constitute security, legal, or compliance advice. Threat details reflect the cited primary sources as published and may change as investigations continue. Organizations should assess their controls against their own environment and obligations, and engage qualified professionals before acting on any control decision described here.
Identity threat · FAQ
Frequently asked questions
An identity-based attack uses valid credentials, sessions, or trusted access to reach systems and data rather than exploiting a software vulnerability. In practice this covers stolen passwords, hijacked sessions, and social engineering that persuades a user or help desk to grant access, as in the Spring Ring campaign, where employees were talked into handing an impersonated technician remote control of their machines.
ITDR is a security discipline that detects and responds to threats targeting identities, such as credential misuse, privilege escalation, and identity-based lateral movement that access management and perimeter tools miss. Gartner defined the category to fill the gap that opens after authentication: identity management decides who gets access, while ITDR monitors whether that access is being abused once granted. It is only as strong as the identity telemetry feeding it.
Multifactor authentication stops many attacks but does not stop all phishing, because adversary-in-the-middle (AiTM) phishing proxies the login and steals the authenticated session token after the user passes MFA. Phishing-resistant methods such as FIDO2 security keys and passkeys defeat that technique, where one-time codes and push approvals can still be relayed or fatigued into approval.
Help-desk social engineering is an attack that manipulates IT support, or impersonates it, to obtain access such as a password reset, MFA re-enrollment, or a remote session. Spring Ring ran the impersonation toward employees over Teams, but the same weakness applies when attackers call a real help desk posing as staff. A scripted identity check before any reset or remote session is the direct countermeasure.
Identity is described as the new perimeter because attackers increasingly reach data through valid accounts and access rather than by breaching a network boundary, so the login is where defense is now decided. The practical consequence is that controls built to watch endpoints and network traffic need to be joined by controls that watch authentication and account behavior, since a legitimate credential used by the wrong person leaves the old perimeter untouched.
