Helpdesk Hijackers Use Teams Vishing to Deliver GoGRPC Backdoor

Summary

A threat actor, likely operating as an initial access broker for ransomware groups, uses Microsoft Teams vishing and Quick Assist to obtain remote access to victim systems. After gaining access, the attacker deploys multiple Go-based backdoors, including the GoGRPC family, along with several SOCKS proxy tools for lateral movement and data exfiltration. The campaign demonstrates growing sophistication through customized PowerShell scripts and advanced communication protocols such as gRPC.

Investigation

ThreatLabz has tracked this activity since January 2026 and analyzed four distinct GoGRPC backdoor variants: Lep, Giver, Pet, and Kind. The investigation documented a shift from unencrypted gRPC communication to TLS-encrypted channels and identified specialized tools such as S3Siphon for stealing data through AWS S3. Researchers also uncovered Python- and Rust-based proxies, including PyGRPC and RSOX, used to maintain persistent network tunnels.

Mitigation

Organizations should enforce strict policies prohibiting unsolicited remote support sessions initiated through Microsoft Teams or Quick Assist. Security teams should monitor for suspicious PowerShell activity, particularly commands that download files from external domains or modify registry Run keys. Restricting outbound gRPC and WebSocket traffic to approved destinations can also help disrupt command-and-control communication.

Response

If malicious activity is detected, affected hosts should be isolated immediately to limit lateral movement and further data exfiltration through SOCKS proxies. Responders should review PowerShell history and registry-based persistence, including entries masquerading as Realtek HD Audio or similar legitimate software. All identified C2 domains and IP addresses should also be blocked at the network perimeter.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully gained initial access and is attempting to establish a persistent C2 channel using a GoGRPC-based implant. To evade detection by signature-based tools, the implant communicates over port 443, masquerading as standard encrypted web traffic. The attacker uses a PowerShell-based wrapper to initiate an outbound connection to a hardcoded C2 IP address on port 443 to receive instructions, simulating the heartbeat of the GoGRPC backdoor.

• Regression Test Script:

  # Simulation of GoGRPC C2 heartbeat over port 443
  # This script mimics an outbound connection to a remote listener
  $C2_IP = "192.168.1.100" # Replace with a reachable test IP in your lab
  $Port = 443
  
  Write-Host "[+] Attempting to simulate C2 communication to $C2_IP on port $Port..."
  
  try {
      $tcpClient = New-Object System.Net.Sockets.TcpClient
      $connect = $tcpClient.BeginConnect($C2_IP, $Port, $null, $null)
      $success = $connect.AsyncWaitHandle.WaitOne(2000, $false)
  
      if ($success) {
          Write-Host "[!] Connection successful. Telemetry should be generated." -ForegroundColor Green
          $tcpClient.EndConnect($connect)
          $tcpClient.Close()
      } else {
          Write-Host "[-] Connection timed out (this is expected if no listener is present)." -ForegroundColor Yellow
      }
  } catch {
      Write-Host "[-] Error: $($_.Exception.Message)" -ForegroundColor Red
  }

• Cleanup Commands:

  # No persistent artifacts are created by the connection script itself.
  # If a listener was started manually (e.g., nc -lvp 443), terminate it:
  Stop-Process -Name "nc" -ErrorAction SilentlyContinue