Loading malware…
GoGRPC is a Go-based Windows backdoor used in campaigns targeting corporate environments through Microsoft Teams voice phishing. Attackers impersonate IT support personnel and persuade employees to approve Microsoft Quick Assist remote-control sessions. After obtaining access, they use PowerShell to download and execute GoGRPC, configure user-logon persistence through the Windows registry, and remove PowerShell command history.
GoGRPC communicates with its command-and-control infrastructure using gRPC over HTTP/2. It registers compromised hosts, maintains connectivity through periodic heartbeat messages, executes arbitrary shell commands, and returns standard output, standard error, and exit codes. Observed commands perform host, user, Active Directory, domain-trust, and security-software reconnaissance. Earlier variants also collect host metadata, including operating-system information, usernames, domain membership, and architecture, and derive an agent identifier from the machine GUID.
Four variants have been identified: Lep, Giver, Pet, and Kind. Lep and Giver use unencrypted gRPC communications and mutex-based single-instance checks; Lep can also conceal artifacts using Windows file attributes. Pet and Kind introduce TLS and identifier obfuscation, while Kind additionally obfuscates protocol definitions. Earlier variants define a network-proxying command, but its relay functionality was not implemented; the command was removed from later variants.
GoGRPC has been deployed alongside BlindDoor for additional backdoor access, S3Siphon for file theft, and RevSocket, PyGRPC, and RSOX for reverse proxying. These companion-tool capabilities are distinct from GoGRPC's own functionality.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
GoGRPC also gathers other information such as the computer name, user name, machine GUID...
It can then receive commands to run discovery tasks, helping attackers assess whether the victim’s environment is valuable for further intrusion.
The backdoor gathers information such as computer name, username, domain details, Windows version, and security software data.
ThreatLabz analyzed the functionality of these tools along with the command-and-control (C2) communication methods used by the attackers.
GoGRPC communicates with its command-and-control infrastructure through gRPC over HTTP/2, usually on port 443.
The proxy opens a WebSocket connection over TLS to a hardcoded C2 server. Once the connection is established, the threat actor can tunnel TCP traffic through the compromised host.
l’acteur exécute un script PowerShell qui télécharge et installe le backdoor GoGRPC
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor deployed after initial access in Microsoft Teams vishing campaigns to help establish persistence and support post-compromise activity inside corporate environments.
Backdoor used after Quick Assist-based initial access. It establishes persistence via a Run registry key, clears PowerShell history, communicates with C2 over gRPC on HTTP/2 via port 443, registers victims with protobuf messages, sends periodic heartbeats, and executes arbitrary shell commands. Variants show increasing obfuscation and protocol changes.
Go-based backdoor deployed after attackers impersonate IT support through Microsoft Teams and obtain remote access through Quick Assist. It executes commands and turns infected computers into network proxies, using gRPC to communicate with control servers. The campaign is suspected of supplying initial access for ransomware operations, but no specific ransomware family is identified.
A Go-based backdoor used after Microsoft Teams vishing and Quick Assist access. It supports command execution, system reconnaissance, persistence via a Windows Registry Run value, and C2 communications over gRPC over HTTP/2; later variants added TLS.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.