42
42
57
57
57
42
42
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Unit 42 details the Spring Ring voice phishing campaign abusing Microsoft Teams to deploy malware and target enterprise domain controllers.
Palo Alto Networks Unit 42 analyzed the Spring Ring campaign, which abuses Microsoft Teams and voice phishing (vishing) to compromise enterprise users. Attackers use Teams calls to social-engineer victims, then deploy malware and advance toward enterprise domain controllers. The report documents the campaign's tactics and provides detection guidance for defenders.
70
47
57
42
57
Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data
Threat actors use voice calls and Microsoft Graph API via BYOD devices to access Microsoft 365, then sell access to extortion groups like ShinyHunters.
Dark Reading reports that threat actors are exploiting BYOD scenarios and voice-based social engineering to gain access to Microsoft 365 environments and corporate data. The actors use Microsoft's Graph API to identify lucrative targets within compromised tenants. Access is then passed to extortion groups such as ShinyHunters, which is known for large-scale data theft and extortion campaigns. The source text is a brief summary, so victim counts and full scope are not specified.
70
57
57
57
57
57
60
57
42
42
57
57
Details emerge on BlackFile's recent attacks on financial companies
BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.
Google Threat Intelligence Group (tracking BlackFile as UNC6671, linked to The Com) reports the extortion group remains active, shifting focus to the financial sector and med tech organizations, with new Redact-brand extortion demands issued last week. The group impersonates IT support in voice-phishing attacks using hundreds of recruited callers, targets large firms in what researchers call big-game hunting, and processes an average of 1.5 new victims daily. Extortion demands start around $3 million and are typically negotiated below $1 million; Flashpoint observed infrastructure targeting Blackstone, Bain Capital, Moody's, CME, and Apollo, though compromise is unconfirmed. Mandiant has responded to more than two dozen BlackFile compromises since January, and victims face escalation tactics including swatting.
70
42
57
57
42
57
57
57
42
42
42
42
42
60
42
42