Loading malware…
PyGRPC is a compiled Python reverse SOCKS proxy used in post-compromise operations against corporate Windows environments. It turns compromised computers into network proxies, allowing operators to route traffic through victim systems and reach network resources accessible from those hosts. PyGRPC communicates with its command-and-control server using gRPC over TLS, applies additional AES encryption to message payloads, and can generate reconnaissance reports for the operator. Its Python code is protected with Pyarmor, providing code obfuscation and resistance to analysis.
PyGRPC has been deployed alongside GoGRPC, BlindDoor, RevSocket, S3Siphon, and RSOX in campaigns involving Microsoft Teams voice phishing. Attackers impersonate IT support personnel and persuade employees to approve Microsoft Quick Assist remote-control sessions, then use PowerShell to gather system information and deploy malware. PyGRPC serves as a supporting reconnaissance and network-tunneling tool rather than the campaign's primary command-execution backdoor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
ThreatLabz analyzed the functionality of these tools along with the command-and-control (C2) communication methods used by the attackers.
The threat actor also deploys SOCKS proxy tools that also use gRPC or WebSockets to communicate with the C2 server.
RevSocket : proxy SOCKS inverse en Go ... PyGRPC : proxy SOCKS inverse en Python ... RSOX : ... proxy SOCKS relay
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Compiled Python reverse SOCKS proxy protected with Pyarmor, using gRPC over TLS plus additional AES encryption and capable of sending reconnaissance reports.
Supporting tool that converts compromised computers into network proxies, allowing attackers to reach other systems through victims’ machines or obscure traffic origins.
A Python-based tool used in the same operation; the IoC list describes it as 'PyGRPC and reconnaissance tool,' indicating reconnaissance support alongside backdoor functionality.
Additional malware used in the same campaigns alongside GoGRPC.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.