Do Son 
At a glance
| Actor | Unnamed threat actor, likely a ransomware initial access broker |
|---|---|
| Activity | Vishing-led intrusion and custom backdoor deployment |
| Targets | Corporate and enterprise Windows environments |
| Scale | Four backdoor variants tracked since January 2026; victim count not disclosed |
| Status | No named-group attribution; no arrests reported |
| Source | Zscaler ThreatLabz |
TL;DR
Zscaler ThreatLabz is tracking a new GoGRPC backdoor used in Microsoft Teams vishing attacks. The operator poses as IT support, then hijacks Quick Assist to seize control. Researchers link the campaign to a likely ransomware access broker.
What happened
The attack starts with noise. First, the operator floods a target’s inbox with spam. Then a Microsoft Teams call arrives from someone posing as helpdesk staff. The caller offers to fix the “problem” and asks the victim to open Quick Assist. That single click opens a remote session on the victim’s machine.
The trick works because every step looks normal. Teams calls feel internal, so they slip past phone spam filters. Quick Assist is a built-in Windows tool, so it raises few alarms. Voice pressure then rushes the victim past second thoughts.
Next comes the payload. Over the session, the attacker runs PowerShell to profile the host and fetch malware. One script also writes a registry Run key for persistence. The main tool is a Go-based implant that ThreatLabz named GoGRPC.
Inside the GoGRPC backdoor
ThreatLabz found four GoGRPC variants and named them Lep, Giver, Pet, and Kind. Lep appeared first, on January 6, 2026. Kind surfaced on June 2, 2026. The variants share features but differ in code and stealth. As the report puts it, “GoGRPC is actively evolving.”
Once running, the backdoor quietly maps the machine. It queries the registry for the Windows version and build number. It also collects the computer name, user name, and a machine GUID that serves as an agent ID. The implant then registers with its server and waits for tasks. Observed commands gathered domain and account data, which is classic groundwork for spreading across a network.
The command channel is the unusual part. GoGRPC talks to its server using gRPC over HTTP/2 on port 443. That choice is rare for malware. As ThreatLabz notes, “using gRPC can help maintain a low communication profile.” Early variants skipped encryption, while Pet and Kind added TLS. After it registers, the implant sends periodic heartbeats to keep the link alive and to accept new tasks.
Stealth improved over time. In the Pet and Kind builds, the authors obfuscated method names, variable names, and structure fields. That change slows analysis and makes sample comparison harder. The Kind variant even renamed its network endpoint and hid its gRPC definitions. Lep and Giver, by contrast, checked for duplicate infections through a mutex.
A growing malware toolkit
GoGRPC rarely travels alone. The operator also drops BlindDoor, a simple command-runner backdoor. Two reverse SOCKS proxies, RevSocket and PyGRPC, tunnel traffic through the victim. A Rust relay named RSOX does similar work over WebSockets. For theft, a tool named S3Siphon copies documents, pictures, and other files straight to an attacker-controlled AWS S3 bucket.
PyGRPC stands out among these tools. It is a compiled Python proxy, shielded by Pyarmor, and it wraps messages in an extra layer of AES encryption. RSOX, meanwhile, can pull its server address from an environment variable. That flexibility lets the operator swap infrastructure on the fly.
Who is behind it
Attribution stays cautious. ThreatLabz describes the operator as a “likely” initial access broker for ransomware attacks. That wording signals a suspected role, not a confirmed identity. No named group has claimed the activity, and no arrests have been reported. Researchers do see overlap with earlier helpdesk-impersonation campaigns tracked by Microsoft and others.
Impact and scale
The campaign is narrowing its aim. Since June 2026, the actor has grown pickier about victims. New PowerShell scripts hunt for antivirus, EDR, and domain controllers before the next stage. Those checks help the operator judge whether a network is worth the effort. The recon pattern points toward lateral movement and, later, extortion. Zscaler has not published a victim count, so the true scale remains unclear.
How to stay protected
Defense starts with the phone call. Train staff to verify any IT caller through a known internal channel. Treat unexpected Teams calls from “support” as suspect. Where possible, limit or disable Quick Assist for standard users.
Monitoring matters too. Watch for unusual PowerShell that downloads files or sets Run keys. Flag odd HTTP/2 and gRPC traffic leaving the network. Strong EDR and fast host isolation blunt the follow-on tools. Alerts on new outbound connections to unfamiliar cloud storage can also catch data theft early. This GoGRPC backdoor research also lines up with prior Teams vishing coverage from Microsoft’s response team.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
