Malware News Zscaler ThreatLabz is tracking a threat actor that is likely an initial access broker for ransomware attacks.

[Khushal]

Content source

https://www.zscaler.com/blogs/security-research/helpdesk-hijackers-teams-vishing-quick-assist-and-gogrpc-backdoor

Introduction​

Zscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging vishing techniques through Microsoft Teams and deploying a variety of tools including a Go-based backdoor that we named GoGRPC. ThreatLabz has identified at least four variants of GoGPRC that we named Lep, Giver, Pet, and Kind. In some instances, the threat actor has deployed additional malware tools that include a backdoor that we named BlindDoor, a Go-based reverse SOCKS proxy we named RevSocket, a Python-based reverse SOCKS proxy we named PyGRPC, and two other tools we named S3Siphon and RSOX.

In this blog post, ThreatLabz examines the four GoGRPC variants, highlighting where they overlap and how they differ. We also analyze their command-and-control (C2) communication protocols and summarize the additional malware tools observed in these campaigns.

Technical Analysis of GoGRPC | ThreatLabz

A threat actor likely associated with ransomware is using Microsoft Teams vishing and Quick Assist to deliver new backdoors and proxy tools.

www.zscaler.com

Key Takeaways​

• Since January 2026, ThreatLabz tracked a cluster of attacks likely associated with a ransomware group that begins with targeted vishing via Microsoft Teams, convincing the victim to launch a Quick Assist remote support session.
• After initial access, the threat actors use PowerShell scripts to gather host information and deploy a Go-based backdoor that we named GoGRPC and/or other malware tools.
• ThreatLabz observed four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. These variants have overlapping capabilities but notable implementation differences.
• GoGRPC is actively evolving. Each variant modifies its payloads and capabilities, adding or removing functionality to better support the threat actor’s objectives. Recent changes indicate an increased targeting of corporate environments, which may be tied to ransomware attacks.
• GoGRPC communicates with the C2 server using gRPC, which differs from common C2 frameworks where gRPC is typically used for internal communication between components.
• The threat actor also deploys SOCKS proxy tools that also use gRPC or WebSockets to communicate with the C2 server.

 

[Bot]

Security implications

Based on the excerpt, this campaign combines social engineering with legitimate remote-support functionality and post-compromise tooling. The initial Quick Assist session is especially important because the victim may authorize the activity themselves, allowing the attacker to bypass some traditional malware-delivery controls.

Organizations should prioritize:

• Restricting or centrally managing Microsoft Quick Assist and Microsoft Teams external communication where practical.
• Training help-desk and technical-support staff never to accept unsolicited remote-support requests or share session codes based only on a phone or Teams conversation.
• Reviewing Microsoft 365, Teams, Quick Assist, PowerShell, and endpoint telemetry for unusual support sessions followed by reconnaissance or script execution.
• Monitoring for unexpected Go binaries, Python tooling, SOCKS proxies, reverse tunnels, and outbound gRPC or WebSocket connections.
• Using application control and PowerShell logging, including Script Block Logging and transcription where appropriate.
• Investigating newly created scheduled tasks, services, startup entries, remote-access tools, and credential-access activity after a suspicious support session.

The presence of gRPC alone should not be treated as malicious; it is also used legitimately. Detection should correlate the protocol with the process initiating it, the destination, timing, execution path, and preceding user activity. Similarly, a Go-compiled binary or Python process is not automatically malicious without additional evidence.

The excerpt also contains an apparent naming inconsistency: it mentions “GoGPRC” once, while the variants and the remainder of the text use “GoGRPC.” The original ThreatLabz report should be used for the authoritative spelling, indicators, hashes, and detection guidance.

The most useful defensive action is to obtain the complete report’s IOCs and detection rules, then combine them with identity, endpoint, Teams, and network telemetry. An isolated suspicious host should be handled through the organization’s incident-response process rather than relying only on an antivirus scan.