[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ9EdQjhWslRpXw-f0ST7aBqlu71IPNWt6xB77belHdI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"d0ade93e-be38-4107-9c30-02f446e445ac","fake-it-support-calls-on-teams-deploy-gogrpc-backdoor","8fa1df06-388a-4f2f-b57c-a9e3e7836efe","Fake IT Support Calls on Teams Deploy GoGRPC Backdoor","Attackers are impersonating IT support staff on Microsoft Teams to socially engineer employees into granting remote access via Microsoft's own Quick Assist tool, a classic vishing (voice phishing) attack vector. Once access is granted, they deploy the GoGRPC backdoor, enabling persistent command execution and network proxying — likely as a precursor to ransomware deployment. This attack exploits employee trust in internal communication platforms and legitimate remote support tools, bypassing traditional perimeter defenses entirely. The human element remains one of the most exploited weaknesses in enterprise security, and the use of trusted, built-in tools makes detection significantly harder. Organizations that lack strict verification procedures for IT support requests are especially vulnerable to this type of initial access broker operation.","**Immediate actions:**\n- Restrict or disable Microsoft Quick Assist and other remote access tools via Group Policy for users who do not require them for their role.\n- Issue an urgent security advisory to all staff reminding them never to grant remote access in response to unsolicited Teams messages or calls, even from apparent IT contacts.\n- Block or audit outbound connections to unknown GRPC\u002Fproxy endpoints at the network perimeter.\n\n**Long-term improvements:**\n- Implement a verified IT support request process requiring employees to initiate support tickets through an official portal before any remote session is permitted.\n- Enforce a Zero Trust access model so that even legitimate remote access sessions require multi-factor authentication and are scoped to least-privilege.\n- Conduct regular, scenario-based phishing and vishing simulation training to build employee resilience against social engineering tactics.\n\n**Detection measures:**\n- Deploy EDR\u002FXDR solutions configured to alert on unusual processes spawned via Quick Assist or other remote desktop tools, particularly GoLang-compiled binaries.\n- Enable detailed logging of Microsoft Teams external communications and remote assistance sessions, and feed these into your SIEM for anomaly detection.\n- Monitor for unusual outbound network traffic patterns consistent with command-and-control or proxying activity (e.g., persistent GRPC connections to external IPs).",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 IR-6: Incident Reporting","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1566.004: Phishing – Vishing","MITRE ATT&CK T1059: Command and Scripting Interpreter","ITIL Service Desk Verification Procedures",{},"published","2026-07-28T12:22:00.41703+00:00","2026-07-28T12:22:00.318+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fhackread.com\u002Ffake-it-calls-microsoft-teams-gogrpc-backdoor\u002F","fake-it-calls-on-microsoft-teams-lead-to-gogrpc-backdoor-infections-d16b1c","Fake IT Calls on Microsoft Teams Lead to GoGRPC Backdoor Infections",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":62,"name":63,"problem":64},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]