A recent cyberattack campaign exploiting Microsoft Teams involves deceptive IT support calls to gain unauthorized access to corporate networks. This scheme employs the Quick Assist tool to install GoGRPC, a Go-based backdoor, giving attackers the ability to execute commands and gather system information while maintaining access.
Threat Actor Tactics and Tools
The campaign is attributed to a threat actor potentially serving as an initial access broker for ransomware attacks. Their strategy includes overwhelming targets with email spam, impersonating Microsoft Teams users, and initiating Quick Assist sessions to manipulate employees into complying with illegitimate support requests.
Cybersecurity firm Zscaler uncovered the operation while monitoring activities from January to June 2026. Their analysis reveals that the threat group has enhanced its toolkit and increasingly targets corporate environments. The campaign underscores the risks associated with remote support utilities when users are deceived into granting access.
Technical Details of the Attack
The attack typically starts with a method known as spam bombing, where victims receive numerous disruptive messages. During this confusion, attackers posing as IT helpdesk staff contact the victims via Microsoft Teams, urging them to initiate a Quick Assist session and allow remote access.
Once inside, attackers use PowerShell to deploy additional malicious payloads. The GoGRPC backdoor, once installed, ensures persistence by modifying Windows Registry entries, enabling it to run again upon user login. Zscaler identified four GoGRPC variants—Lep, Giver, Pet, and Kind—each differing in encryption use, code obfuscation, and command execution capabilities.
Mitigation and Security Recommendations
To mitigate the threat, organizations must enforce verification of unexpected support requests via recognized internal channels before initiating remote sessions. Limiting external communications on Microsoft Teams and restricting Quick Assist usage to authorized IT personnel can significantly reduce the risk of falling victim to such scams.
Security teams are advised to monitor for anomalous PowerShell activities, unauthorized Registry entries, and unusual outbound gRPC or WebSocket connections. Implementing robust incident-response protocols can help prevent further exploitation and potential ransomware attacks.
Employees should remain vigilant against unsolicited Teams messages and Quick Assist requests, even if they appear to originate from IT. Early detection and response are crucial to averting the kind of secondary ransomware incidents increasingly observed in similar operations.
For further protection, continuously update security measures and train staff to recognize and report suspicious activities promptly. This proactive approach is vital to defending against evolving cyber threats.
