Loading story…
Attackers used Microsoft Teams vishing calls and Quick Assist remote sessions to gain access to corporate environments, then launched PowerShell-based staging that deployed a Go-based backdoor family dubbed GoGRPC. Zscaler ThreatLabz said the activity was observed from January through June 2026 and likely reflects an initial access broker operation aligned with ransomware follow-on activity, with targeting that increasingly shifted toward higher-value enterprise victims.
Researchers identified four GoGRPC variants—Lep, Giver, Pet, and Kind—that evolved over time with added TLS support, obfuscation, and changes to gRPC-based command-and-control. The malware fingerprints infected hosts, registers with C2 infrastructure, executes reconnaissance, and can work alongside additional tools including BlindDoor, S3Siphon, RevSocket, PyGRPC, and RSOX to provide proxying, tunneling, and broader post-compromise access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
ThreatLabz identified four GoGRPC variants—Lep, Giver, Pet, and Kind—and reported that the malware evolved over time with capabilities such as TLS support, obfuscation, and changes to gRPC-based command-and-control communications. The report said the actor's tooling became more sophisticated and increasingly targeted higher-value corporate environments.
After gaining access, the attackers used PowerShell-based staging to deploy a Go-based backdoor family named GoGRPC and, in some cases, additional malware including BlindDoor, S3Siphon, RevSocket, PyGRPC, and RSOX. The tooling supported host fingerprinting, C2 registration, reconnaissance, and proxying or tunneling functions.
Zscaler ThreatLabz reported a cluster of attacks observed from January through June 2026 in which attackers used Microsoft Teams vishing and Quick Assist remote sessions for initial access. The activity was assessed as likely involving an initial access broker supporting ransomware operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcemalware.news
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026
Microsoft and Sophos reported separate but closely aligned social-engineering campaigns in which attackers impersonated IT support staff over Microsoft Teams, phone calls, and related pretexts to trick employees into granting remote access through **Quick Assist** or other support tools. Microsoft attributed its activity to **Storm-1811**, which used vishing and email-bombing to gain access, steal credentials through **EvilProxy**, and deploy tools including **Qakbot**, **Cobalt Strike**, **ScreenConnect**, **NetSupport Manager**, **OpenSSH** tunneling, and **SystemBC** before rolling out **Black Basta** ransomware with **PsExec**. Microsoft said it suspended malicious Teams accounts and tenants involved in the impersonation activity and added stronger Quick Assist warnings and trust indicators.
Jul 29, 2026
**BlueVoyant researchers identified a social-engineering campaign** in which operators linked to **Blitz Brigantine / Storm-1811 / STAC5777**, a cluster associated with the **Black Basta** ecosystem, impersonate IT support over **Microsoft Teams** after overwhelming targets with spam email. Victims are persuaded to launch **Quick Assist**, giving the attackers remote access that is then used to deploy **A0Backdoor** through digitally signed MSI packages masquerading as legitimate Microsoft software such as *Microsoft Teams* and *CrossDeviceService*. The activity has targeted organizations in sectors including **finance** and **healthcare**, and the use of multiple code-signing certificates suggests the operators prepared the toolchain well before the observed intrusions. Once installed, **A0Backdoor** fingerprints the host and communicates with operators using **DNS tunneling** over public resolvers, helping the malware blend into normal traffic while maintaining persistence and command-and-control. The reporting is substantive threat intelligence rather than promotional or advisory content, and the only other mention of the same event is a newsletter item that cites the A0Backdoor research as one entry among many malware stories. Other references in the set cover unrelated vulnerabilities, policy developments, AI security issues, phishing, ransomware trends, and separate malware campaigns, and do not describe this specific Teams-and-Quick-Assist intrusion chain.
Jun 29, 2026