GOGRPCGoGRPC

GoGRPC is a Go-based backdoor named by Zscaler ThreatLabz in July 2026, used since January 2026 by a threat actor that ThreatLabz assesses is likely an initial access broker for ransomware attacks. Victims are spam-bombed, then called over Microsoft Teams by operators impersonating the helpdesk and persuaded to open a Quick Assist session; PowerShell gathers host information, copies the payload to %APPDATA% as sekv<random>.exe and persists through a 'Realtek HD Audio' value under the HKCU Run key. GoGRPC communicates over gRPC on HTTP/2 (port 443, endpoint /agent.AgentService/Connect, renamed /Refuse/Connect in the latest variant), registers with host fingerprinting (machine GUID as agent ID), sends heartbeats and executes shell commands returning stdout, stderr and exit code; most variants log to %PROGRAMDATA%\appscreen\appscreen.log. ThreatLabz describes four variants it labelled Lep (January 2026), Giver (February 2026), Pet (April 2026) and Kind (June 2026), adding TLS and obfuscation over time; an unimplemented proxy command was dropped in later versions. The same actor deployed BlindDoor, the RevSocket and PyGRPC reverse SOCKS proxies, the S3Siphon exfiltration utility and the RSOX Rust relay. In October 2026 Arctic Wolf, analysing more than 400 Teams IT-support impersonation incidents, listed GoGRPC among payloads delivered before lateral movement to domain controllers, installation of the Level RMM, exfiltration and ransomware, crediting Zscaler, and related the activity to the STAC4749 cluster that Sophos linked to Chaos ransomware. The loader Sophos documented for STAC4749 shares GoGRPC's artifacts (sekv-prefixed filename, 'Realtek HD Audio' Run value, appscreen.log check, gRPC C2), but no vendor states that they are the same; ThreatLabz names no ransomware group.