Hackers Pose as IT Helpdesk on Microsoft Teams to Deploy GoGRPC Backdoor

An evolving intrusion campaign in which threat actors impersonate IT helpdesk personnel via Microsoft Teams to gain initial access and deploy a custom Go-based backdoor dubbed “GoGRPC.”

Active since January 2026, the activity is assessed to be linked to an initial access broker (IAB) operation that likely facilitates downstream ransomware attacks.

Aligning with tactics observed in campaigns such as Payouts King and Microsoft-documented cross-tenant helpdesk impersonation intrusions.

Posing as internal IT support, the attackers persuade users to launch a Quick Assist remote session, effectively granting interactive access.

This social engineering vector mirrors techniques highlighted in Microsoft’s April 2026 report on human-operated intrusions leveraging Teams-based vishing.

Once access is established, the operators execute PowerShell-based staging scripts to profile the host and deploy payloads.

Central to the campaign is GoGRPC, a modular backdoor written in Go that communicates with command-and-control (C2) infrastructure using gRPC over HTTP/2 an uncommon choice for external C2 traffic that helps blend malicious communications with legitimate enterprise traffic on port 443.

ThreatLabz identified four distinct GoGRPC variants Lep, Giver, Pet, and Kind tracked chronologically from January through June 2026. The attack chain begins with targeted “spam bombing,” overwhelming victims with email noise before initiating contact through Microsoft Teams.

While earlier variants such as Lep and Giver include system fingerprinting, mutex-based execution control, and limited obfuscation, later variants (Pet and Kind) introduce stronger stealth mechanisms including TLS-encrypted C2 communication, obfuscated method structures, and removal of identifiable host-based agent IDs.

The Kind variant further modifies protocol endpoints and obfuscates gRPC definitions, signaling active development and operational refinement.

Following execution, GoGRPC establishes persistence via registry Run keys and begins host reconnaissance. It collects detailed system information, including Windows version, domain context, username, hostname, and machine GUID, which is used to uniquely identify infected systems.

The malware then registers with the C2 server using a structured protobuf-based handshake and enters a tasking loop, executing commands such as system enumeration, Active Directory discovery, antivirus inspection, and privilege assessment.

These behaviors strongly indicate pre-ransomware reconnaissance consistent with IAB tradecraft.

Notably, GoGRPC supports arbitrary command execution via the Go os/exec library, returning stdout and stderr outputs to the operator.

While earlier variants defined proxy tunneling capabilities, implementation appears incomplete and was later removed, suggesting a shift toward dedicated proxy tooling.

GoGRPC Backdoor Deployed

In parallel with GoGRPC, ThreatLabz observed deployment of multiple auxiliary tools that enhance persistence, lateral movement, and data exfiltration.

These include BlindDoor, a lightweight backdoor using a simple command-response protocol; S3Siphon, a data exfiltration utility targeting user directories and uploading files to attacker-controlled AWS S3 buckets; and several SOCKS proxy frameworks such as RevSocket, PyGRPC, and RSOX.

RevSocket leverages WebSockets over TLS with yamux multiplexing to tunnel traffic, while PyGRPC introduces AES-encrypted gRPC communications.

The most recent addition, RSOX, is a Rust-based proxy that supports dynamic C2 configuration and authenticated session control using JSON-based messaging.

These tools enable flexible post-exploitation routing and covert lateral movement within corporate environments.

A key technical distinction in this campaign is the use of gRPC for external C2 communication, unlike frameworks such as Sliver or Mythic where gRPC is typically confined to internal components.

ThreatLabz notes a clear evolution toward more selective targeting, with newer campaigns incorporating environment-aware PowerShell scripts capable of detecting EDR solutions, identifying domain controllers, and evaluating organizational value before deploying full payload chains.

This progression underscores a strategic pivot toward high-value enterprise targets and reinforces the role of Teams-based social engineering as a growing enterprise attack surface.

The findings highlight the increasing convergence of social engineering, living-off-the-land techniques, and modern protocol abuse in ransomware precursor operations, emphasizing the need for stricter controls around remote support tools and enterprise messaging platforms.

Indicators Of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist