The Trust Boundary Is the New Perimeter: Deconstructing the Spring Ring Campaign and the Liquidity of Identity

The silence in the identity layer is louder than any crash in the token market. While the crypto world obsesses over the next liquidity injection, a different kind of capital—trust—is being drained from the enterprise collaboration stack. Palo Alto Networks' Unit42 recently pulled back the curtain on 'Spring Ring,' an APT campaign that didn't exploit a zero-day in a DeFi protocol or a smart contract bug. It weaponized the default configuration of Microsoft Teams, turning the most trusted communication channel in the modern enterprise into a front door for domain compromise. This isn't just a cybersecurity incident; it's a macro signal about where the true attack surface of the digital economy now resides. We are chasing ghosts in the algorithmic machine of price charts, while the real systemic risk is hiding in plain sight, inside the human pulse of our daily workflows. The campaign, active from January to April 2026 and attributed to Cloaked Ursa (a group with APT29 / Muddled Libra associations), targeted over 10 organizations and more than 150 employees. The attack chain is a masterclass in systemic contagion mapping, but not of the financial kind. It maps the contagion of trust. The attackers registered their own .onmicrosoft.com tenants, adopting professional personas like 'ITProtectionDepartment' to impersonate help desk staff. They initiated unsolicited chats and voice calls, bypassing traditional email security gateways entirely. This is the 'Hidden Current'—the flow of social engineering that moves beneath the surface of technical defenses. The attack path—Teams chat to vishing, to RMM access, to NTLM relay, to Pass-the-Hash, to domain-level privileges—is a liquidity cascade, but the asset being drained is organizational trust and, ultimately, control. Let's map the liquidity of this attack surface. The core insight here is that the perimeter has fundamentally shifted. For years, we've built moats around the network, the endpoint, and the email gateway. But the Spring Ring campaign demonstrates that the most liquid, most accessible attack surface is now the identity layer, specifically the cross-tenant trust boundaries of SaaS platforms. Teams external access is enabled by default in most M365 tenants. This is a structural liquidity provision for attackers. It's a standing order that allows any external entity with a registered tenant to initiate contact with any internal user. The Unit42 Cortex telemetry shows a 41% increase in Teams-based attacks from October 2025 to March 2026, and collaboration-tool phishing alerts now account for 42% of all phishing alerts, up from 30% in the previous four months. This isn't a blip; it's a trend line pointing to a structural shift in attacker behavior. They are following the liquidity of human attention and trust, which has migrated from the inbox to the chat client. The technical execution of the two campaigns reveals a sophisticated understanding of this new terrain. Campaign A was a broad-stroke operation, deploying RMM tools and an obfuscated PowerShell RAT, disabling AMSI, and performing local enumeration. It was blocked by Cortex XDR. Campaign B, however, was a more targeted, surgical strike. It used S3-hosted files named after the victim company and usernames, generated persistence mechanisms, and leveraged a headless Edge browser for session hijacking. The novel part, as Unit42 notes, is the delivery mechanism: Teams chat to vishing to RMM access to NTLM relay to Pass-the-Hash. This is a multi-hop transaction, and each hop is a different asset class of trust. The final hop, the PetitPotam NTLM relay attack against the domain controller, is particularly telling. PetitPotam (CVE-2021-36942) was patched in August 2021. Yet, in 2026, it's still a viable escalation path. This is the technical debt of the identity layer. It's like finding a vulnerability in a legacy smart contract that was supposed to be deprecated but is still holding a significant portion of the total value locked. The illusion of control in a fluid world is that we believe patching a vulnerability in one layer secures the entire stack. It doesn't. The trust boundary is only as strong as its weakest, oldest component. Now, for the contrarian angle. The conventional wisdom is that this is a Microsoft problem, a Teams configuration issue. But the deeper, more uncomfortable truth is that this is a systemic failure of the 'low-friction growth' model that underpins modern SaaS. The attackers are, in a perverse way, the most effective PLG (Product-Led Growth) practitioners. They self-serve, they onboard, they activate, and they expand—all within the product's intended mechanics. The platform's efficiency in matching users across organizational boundaries is precisely what makes it an efficient attack vector. This is the dark side of network effects. The very features that make Teams indispensable—its ubiquity, its low-friction external collaboration, its deep integration with the Microsoft ecosystem—are the features that make it a perfect conduit for domain compromise. The real issue isn't just a default setting; it's the philosophical commitment to frictionless connection over secure verification. We are reading the silence between the blockchain blocks, but we should be reading the silence between the chat messages. The silence is the absence of a trust verification step. The market is pricing in the risk of smart contract hacks, but it's not pricing in the risk of a compromised identity layer that can lead to a full domain takeover, which is a far more systemic event for any enterprise. Where does this leave us in the cycle? For the crypto and digital asset space, this is a critical lesson in infrastructure trust. As institutions increasingly bridge traditional finance with digital assets, the security of their identity and collaboration infrastructure becomes the new custodial risk. The 'Spring Ring' campaign is a reminder that the most sophisticated attacks don't target the code; they target the human and the system of trust that surrounds the code. The takeaway is not to disable Teams or to panic, but to recognize that the perimeter is now the trust boundary. The question for every CISO, and every macro observer, is not 'Is my endpoint protected?' but 'Who can initiate a conversation with my CEO, and what is the verification mechanism for that interaction?' The next major exploit won't be a flash loan attack; it will be a social engineering campaign that leverages the default trust of our most-used platforms. The liquidity of trust is the new macro indicator, and right now, the chart is flashing red. The question is, are we reading the right chart?