Technical Analysis of GoGRPC | ThreatLabz

Zscaler ThreatLabz has identified a threat actor operating since January 2026 that conducts vishing attacks via Microsoft Teams to trick victims into launching Quick Assist remote support sessions, enabling initial access. The actor deploys a Go-based backdoor named GoGRPC, with four observed variants (Lep, Giver, Pet, Kind), each exhibiting evolving capabilities including gRPC-based C2 communication over HTTP/2 on port 443. Additional malware tools such as BlindDoor, S3Siphon, RevSocket, PyGRPC, and RSOX are used for persistence, reconnaissance, data exfiltration, and proxying, indicating a sophisticated campaign likely supporting ransomware operations.

AI-extracted · verify before operational use