Evolving Intrusion Campaign Utilizes Microsoft Teams for Initial Access
In a disturbing trend, an emerging intrusion campaign has come to light in which threat actors impersonate IT helpdesk personnel through Microsoft Teams. This strategy is aimed at gaining initial access to systems and deploying a custom backdoor known as "GoGRPC," which is built using the Go programming language. The campaign has been active since January 2026 and is believed to be part of a larger scheme linked to Initial Access Brokers (IABs), who are likely facilitating subsequent ransomware attacks.
The tactics employed in this campaign align closely with techniques observed in past operations, such as those detailed in reports on "Payouts King" and documented cross-tenant helpdesk impersonation intrusions by Microsoft. In this context, the attackers masquerade as internal IT support staff, using social engineering techniques to convince unsuspecting users to initiate a Quick Assist remote session. This action effectively offers the intruders interactive access to the victim’s system, a strategy that closely mirrors methods highlighted in Microsoft’s April 2026 report concerning human-operated intrusions utilizing Teams-based voice phishing (vishing).
Once access is gained, the attackers execute PowerShell-based staging scripts to gather information about the host system and deploy their payloads. Central to their operation is the GoGRPC backdoor, a modular piece of malware that communicates with command-and-control (C2) infrastructure over the gRPC protocol using HTTP/2. This choice of communication channel is somewhat uncommon for external C2 traffic, thereby enabling malicious communications to blend in with legitimate enterprise traffic on port 443, complicating detection efforts.
ThreatLabz, a cybersecurity research entity, has identified four distinct variants of GoGRPC—dubbed Lep, Giver, Pet, and Kind—that have been tracked from January through June 2026. The attack chain begins with targeted "spam bombing," which overwhelms victims with a barrage of emails before the actors initiate contact via Microsoft Teams.
The earlier variants like Lep and Giver include system fingerprinting capabilities, mutex-based execution control, and limited obfuscation techniques. In contrast, the later iterations, specifically Pet and Kind, introduce enhanced stealth mechanisms. These include TLS-encrypted C2 communication, more complex obfuscation of method structures, and the removal of identifiable host-based agent IDs. The Kind variant, in particular, further modifies protocol endpoints and obfuscates gRPC definitions, indicating ongoing development and refinement of these malicious tools.
Once the attack is executed, GoGRPC establishes persistence within the compromised system by modifying registry Run keys and begins to conduct host reconnaissance. It collects detailed data, such as the Windows version, domain context, username, hostname, and machine GUID used for unique system identification. Following this, the backdoor registers with the C2 server through a structured protobuf-based handshake and enters a continuous tasking loop. This allows it to carry out commands like system enumeration, Active Directory discovery, antivirus inspections, and privilege assessments—behaviors indicative of pre-ransomware reconnaissance, consistent with IAB tradecraft.
Moreover, GoGRPC supports arbitrary command execution through the Go’s os/exec library. This allows the attackers to receive standard output and error feedback, facilitating real-time control. Although earlier variants included proxy tunneling features, this aspect was apparently removed in later versions, suggesting a move toward more specialized proxy tools.
Alongside the deployment of GoGRPC, ThreatLabz has noted the use of various auxiliary tools to bolster persistence, enable lateral movement, and facilitate data exfiltration. These tools include BlindDoor, a lightweight backdoor that operates using a straightforward command-response protocol; S3Siphon, which targets user directories for data exfiltration and uploads information to AWS S3 buckets controlled by the attackers; and several SOCKS-based proxy frameworks, such as RevSocket, PyGRPC, and RSOX.
RevSocket employs WebSockets over TLS with yamux multiplexing to tunnel traffic, while PyGRPC enhances security through AES-encrypted gRPC communications. The most recent entry, RSOX, is notable for being a Rust-based proxy that supports dynamic C2 configuration and authenticated session control through JSON messaging.
This campaign’s technical approach marks a significant departure from typical operations that utilize gRPC internally. ThreatLabz highlights a clear shift towards more selective targeting, with newer campaigns using environment-aware PowerShell scripts capable of detecting Endpoint Detection and Response (EDR) solutions, identifying domain controllers, and evaluating the organizational significance of targets before deploying full payload chains.
The findings underscore a critical evolution within cyber threats, merging social engineering tactics, living-off-the-land strategies, and modern protocol abuse in ransomware precursor operations. This highlights an urgent need for stricter controls surrounding remote support tools and enterprise messaging platforms to safeguard organizations from such sophisticated intrusion attempts.