Zscaler tracks GoGRPC backdoor used in Teams vishing attacks

Zscaler ThreatLabz has been tracking a threat actor since January 2026 that uses Microsoft Teams vishing and Quick Assist to deploy a Go-based backdoor named GoGRPC. The actor is likely an initial access broker for ransomware attacks.

ThreatLabz identified four GoGRPC variants, named Lep, Giver, Pet, and Kind, with recent versions adding TLS and obfuscation. The campaigns also used additional tools including BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX.

The initial compromise often starts with spam bombing the victim’s inbox, followed by a Teams call posing as IT support. The attacker persuades the victim to open a Quick Assist link, then runs a PowerShell command that downloads and executes GoGRPC and sets persistence via a registry Run key.

GoGRPC performs system fingerprinting and registers with a command-and-control server using gRPC over HTTP/2, which helps blend with legitimate traffic. The observed commands indicate reconnaissance for lateral movement, consistent with an initial access broker’s activities.