Cybersecurity researchers have identified a social engineering campaign where threat actors pose as internal IT helpdesk staff to gain unauthorized access to corporate systems. The attackers initiate contact through Microsoft Teams, leveraging the platform's legitimacy to build trust with targeted employees before convincing them to grant remote access using Windows Quick Assist.
Once remote access is established, the attackers deploy a previously unknown backdoor dubbed GoGRPC. The malware is written in the Go programming language and uses the gRPC framework for command-and-control communications, providing attackers with persistent remote access to compromised systems. Security researchers analyzing the threat believe this backdoor serves as an initial access tool for subsequent ransomware deployment.
The attack chain exploits both technical tools and human psychology. Microsoft Teams provides an air of legitimacy since it appears as an internal communication, while Quick Assist is a legitimate Windows remote support tool that many employees recognize and trust. By combining these elements, attackers bypass traditional security controls that focus primarily on email-based phishing or malicious downloads.
The GoGRPC backdoor represents a concerning evolution in attacker tooling. Its use of modern programming languages and legitimate communication protocols makes detection more challenging for traditional security solutions. The suspected connection to ransomware operations suggests that organizations compromised through this method face significant risk of data encryption, exfiltration, and extortion.
Security teams should implement immediate countermeasures including verification procedures for all remote support requests, even those appearing to originate from internal Teams accounts. Organizations should consider restricting Quick Assist to authorized IT personnel only, implement multi-factor authentication for remote access tools, and educate employees about social engineering tactics that abuse trusted communication platforms. Network monitoring should include detection rules for unusual gRPC traffic patterns and Go-based executables.
Source: https://hackread.com/fake-it-calls-microsoft-teams-gogrpc-backdoor/