Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor

The blog analyzes a six-month intrusion campaign attributed to an initial access broker believed to provide ransomware groups with access to compromised environments. The operator gains initial access by flooding the target’s mailbox with unsolicited messages, then impersonating internal IT support through Microsoft Teams. The victim is persuaded to initiate a Quick Assist session, giving the operator remote access to execute PowerShell and deploy a custom Go backdoor tracked as GoGRPC. The deployment command downloads and executes the payload, removes its Mark-of-the-Web metadata, establishes logon persistence through a registry value disguised as an audio driver, and deletes the PowerShell command history.

The report documents four GoGRPC variants that communicate over gRPC and HTTP/2 on port 443. The backdoor profiles the compromised system, registers it with the command-and-control server, maintains periodic heartbeats, and supports interactive reconnaissance and command execution. Later variants introduced encrypted communications and progressively stronger code and protocol obfuscation while removing some earlier fingerprinting and mutex functionality.

The operator also deployed a plaintext socket backdoor, reverse SOCKS proxies written in Go, Python, and Rust, and a collection utility that searches user directories and uploads selected files to cloud object storage. In later activity, the staging process became more selective, profiling security products, domain controllers, and the wider environment before deploying a payload, while delivery shifted from standalone executables to installer packages.