Zscaler ThreatLabz tracked a threat actor likely acting as an initial access broker for ransomware, using Microsoft Teams vishing, Quick Assist, and PowerShell to deploy the GoGRPC backdoor and related tools. The campaign evolved through four GoGRPC variants—Lep, Giver, Pet, and Kind—and additional tooling such as BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX to support reconnaissance, proxying, and data theft. #GoGRPC #MicrosoftTeams #QuickAssist #BlindDoor #RevSocket #PyGRPC #S3Siphon #RSOX
Keypoints
- The threat actor likely serves as an initial access broker for ransomware operations and has been active since January 2026.
- Initial compromise begins with spam bombing and Microsoft Teams vishing, where the attacker impersonates IT/helpdesk staff and urges the victim to launch Quick Assist.
- After access is gained, PowerShell is used to download, execute, and persist the GoGRPC backdoor and other malware.
- ThreatLabz identified four GoGRPC variants: Lep, Giver, Pet, and Kind, each with overlapping behavior but different implementations and capabilities.
- GoGRPC uses gRPC over HTTP/2 for C2 communication, with later variants adding TLS support and other changes to reduce detection.
- Additional tools observed include BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX, covering command execution, SOCKS proxying, reconnaissance, and exfiltration.
- Recent activity suggests more selective targeting of corporate environments, likely to support follow-on ransomware activity.
MITRE Techniques
- [T1566 ] Phishing – The actor uses vishing and spam-bombing to deceive victims into enabling access (‘targets organizations by leveraging vishing techniques through Microsoft Teams’; ‘initial compromise … starts with spam bombing the victim’s inbox’).
- [T1114 ] Email Collection/Spamming – The campaign begins with inbox spam bombing to pressure the victim and enable the social-engineering call (‘starts with spam bombing the victim’s inbox’).
- [T1078 ] Valid Accounts – The victim is tricked into opening a Quick Assist session in a helpdesk-like interaction, enabling use of legitimate remote-support access (‘convincing the victim to launch a Quick Assist remote support session’).
- [T1059.001 ] PowerShell – PowerShell scripts are used to download and run payloads, collect information, and perform recon (‘launches a PowerShell command that downloads and executes GoGRPC’; ‘PowerShell scripts to gather host information’).
- [T1105 ] Ingress Tool Transfer – The attacker downloads malware from a remote URL to the victim system (‘Invoke-WebRequest $u -OutFile $p’).
- [T1547.001 ] Registry Run Keys / Startup Folder – Persistence is established by setting a Run key for malware execution at logon (‘creating a registry Run value to start when a user logs in’).
- [T1082 ] System Information Discovery – The malware queries OS version, build, and system details (‘reg.exe query … CurrentMajorVersionNumber’; ‘retrieve information about the victim’s Windows system’).
- [T1033 ] System Owner/User Discovery – It collects computer name and user name for profiling (‘gathers other information such as the computer name, user name’).
- [T1016 ] System Network Configuration Discovery – The actor enumerates domains and trust relationships (‘net user … /domain’; ‘nltest /domain_trusts’).
- [T1046 ] Network Service Discovery – The actor enumerates domain computers and antivirus products (‘([adsiSearcher]”(ObjectClass=computer)”).FindAll().count’; ‘Get-CimInstance … AntiVirusProduct’).
- [T1021.001 ] Remote Services: Remote Desktop Protocol – Quick Assist is used as the remote support mechanism for initial access (‘launch a Quick Assist remote support session’).
- [T1090.001 ] Proxy: Internal Proxy – The malware implements SOCKS-style proxying to relay traffic through the victim host (‘reverse SOCKS proxy’; ‘open a TCP connection to the requested destination’).
- [T1095 ] Non-Application Layer Protocol – GoGRPC uses gRPC over HTTP/2 for C2, which is less common in public C2 frameworks (‘GoGRPC uses gRPC over HTTP/2 to communicate with C2 servers’).
- [T1041 ] Exfiltration Over C2 Channel – S3Siphon uploads files to an AWS S3 bucket for theft (‘exfiltrates files by uploading them to an AWS S3 bucket’).
- [T1005 ] Data from Local System – The actor gathers local files from common user directories before exfiltration (‘iterates through specific directories’).
Indicators of Compromise
- [SHA256 ] Malware samples and tooling – 66b2b22397cea219266afb8cbbb28fe93997c1444f642a183ac8fc9ca1fabed5, 9136ffb749c6cec13b826cd4f25ffdcf170375889feba9fee28dd74c32578f52, and other hashes for Lep/Giver/Pet/Kind, RevSocket, PyGRPC, and RSOX.
- [IP address ] C2 servers and infrastructure – 5.253.59.222, 94.140.114.192, and other C2 IPs used by Lep, Giver, Pet, Kind, RevSocket, S3Siphon, and RSOX.
- [Domain ] Tool delivery and C2 infrastructure – scansec-upd[.]com, re2.filesdwnload[.]top, and other domains used to deploy tools or host C2.
- [URL ] Payload delivery and download location – hxxps://re102.fastwinnow[.]com/download/link used to retrieve GoGRPC.
- [File path ] Dropped payloads and logs – %PROGRAMDATA%appscreenappscreen.log, C:Users********AppDataLocalTempssd.exe, and the APPDATA-path executable used for staging.
- [Registry key/value ] Persistence mechanism – HKCU:SoftwareMicrosoftWindowsCurrentVersionRun with the value name “Realtek HD Audio” used to launch the payload at logon.
- [Mutex ] Instance control – Global[UUID] mutex names used by Lep and Giver to prevent multiple instances.
- [C2 endpoint/path ] gRPC communication endpoint – /agent.AgentService/Connect and /Refuse/Connect used by GoGRPC variants.
- [Environment variables ] RSOX configuration – RSOX_SERVER_URL and RSOX_TOKEN used to configure C2 and authentication.