[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJSuaVJabnlB1Th32srxuWpcxpCVLQMiERxOS3U0WFGM":3},{"article":4,"iocs":55,"watch_terms":81,"solutions":82,"lesson":170},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"8fa1df06-388a-4f2f-b57c-a9e3e7836efe","Fake IT Calls on Microsoft Teams Lead to GoGRPC Backdoor Infections","fake-it-calls-on-microsoft-teams-lead-to-gogrpc-backdoor-infections-d16b1c","Fake helpdesk callers use Microsoft Teams and Quick Assist to access employee computers, where attackers install new GoGRPC backdoor in suspected ransomware operations","Attackers are using vishing tactics on Microsoft Teams, posing as IT support to trick employees into granting remote access via Quick Assist. Once inside, they install the GoGRPC backdoor, written in Go, which allows command execution and network proxying. This campaign is suspected to be an initial access broker operation for ransomware attacks, with stolen data potentially used for extortion.","Fake IT support calls on Microsoft Teams lead to GoGRPC backdoor infections.","https:\u002F\u002Fhackread.com\u002Ffake-it-calls-microsoft-teams-gogrpc-backdoor\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Ffake-it-calls-microsoft-teams-gogrpc-backdoor.jpg","2026-07-28T10:50:55+00:00","2026-07-28T12:00:07.086532+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"Microsoft Teams","product",{"name":21,"type":19},"Quick Assist",{"name":23,"type":24},"gRPC","technology",{"name":26,"type":27},"Microsoft","vendor",{"name":29,"type":27},"Zscaler",{"name":31,"type":24},"Amazon S3","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,59,62,64,66,68,71,74,76,78],{"type":47,"value":57,"context":58},"GoGRPC","New backdoor malware written in Go",{"type":47,"value":60,"context":61},"Lep","Malware variant identified by researchers",{"type":47,"value":63,"context":61},"Giver",{"type":47,"value":65,"context":61},"Pet",{"type":47,"value":67,"context":61},"Kind",{"type":47,"value":69,"context":70},"BlindDoor","Supporting tool for command execution",{"type":47,"value":72,"context":73},"RevSocket","Supporting tool for network proxying",{"type":47,"value":75,"context":73},"PyGRPC",{"type":47,"value":77,"context":73},"RSOX",{"type":47,"value":79,"context":80},"S3Siphon","Utility for uploading files to S3 buckets",[26,29,18],{"controls":83,"vendors":161},[84,112,138],{"slug":85,"name":86,"problem":87,"products":88},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[89,96,104],{"vendor_slug":90,"vendor_name":26,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,122,130],{"vendor_slug":90,"vendor_name":26,"vendor_logo":91,"product_slug":118,"product_name":119,"url":120,"description":121},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":139,"name":140,"problem":141,"products":142},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[143,149,156],{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":144,"product_name":145,"url":147,"description":148},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":150,"product_name":153,"url":154,"description":155},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":157,"product_name":158,"url":159,"description":160},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[162,165],{"slug":90,"name":26,"logo_path":91,"roles":163},[164],"affected",{"slug":166,"name":29,"logo_path":167,"roles":168},"zscaler","\u002Fvendor-logos\u002Fzscaler.png",[169],"reported_by",{"slug":171,"title":172,"body":173,"framework_refs":174,"framework_notes":187},"fake-it-support-calls-on-teams-deploy-gogrpc-backdoor","Fake IT Support Calls on Teams Deploy GoGRPC Backdoor","Attackers are impersonating IT support staff on Microsoft Teams to socially engineer employees into granting remote access via Microsoft's own Quick Assist tool, a classic vishing (voice phishing) attack vector. Once access is granted, they deploy the GoGRPC backdoor, enabling persistent command execution and network proxying — likely as a precursor to ransomware deployment. This attack exploits employee trust in internal communication platforms and legitimate remote support tools, bypassing traditional perimeter defenses entirely. The human element remains one of the most exploited weaknesses in enterprise security, and the use of trusted, built-in tools makes detection significantly harder. Organizations that lack strict verification procedures for IT support requests are especially vulnerable to this type of initial access broker operation.",[175,176,177,178,179,180,181,182,183,184,185,186],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 IR-6: Incident Reporting","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1566.004: Phishing – Vishing","MITRE ATT&CK T1059: Command and Scripting Interpreter","ITIL Service Desk Verification Procedures",{}]