Zscaler Uncovers GoGRPC Backdoor Abusing Microsoft Quick Assist to Target Enterprise Networks

Cybersecurity researchers at Zscaler ThreatLabz have uncovered a sophisticated malware campaign leveraging Microsoft’s legitimate Quick Assist remote support application to compromise enterprise networks.

Active since January 2026, the operation is believed to be conducted by an Initial Access Broker (IAB), a type of threat actor that specializes in gaining unauthorized access to corporate environments before selling or transferring that access to ransomware groups and other cybercriminal organizations.

The campaign demonstrates how trusted remote administration tools continue to be exploited for malicious purposes, enabling attackers to establish persistent access while bypassing traditional security controls.

Zscaler Uncovers GoGRPC Backdoor

According to Zscaler’s investigation, the attackers rely heavily on social engineering rather than exploiting software vulnerabilities. Victims are first overwhelmed with a spam bombing attack, receiving hundreds or even thousands of unwanted emails within a short period.

Shortly afterward, the attackers contact targeted employees through Microsoft Teams, impersonating IT support or corporate helpdesk personnel.

Claiming to assist with the flood of emails or resolve technical issues, they convince victims to launch a Microsoft Quick Assist session, unknowingly granting the attackers remote access to their workstation.

Once the Quick Assist connection is established, the attackers execute PowerShell commands to download additional payloads, establish persistence, and perform reconnaissance across the compromised environment.

This initial foothold enables the threat actors to collect system information, deploy backdoor malware, and identify valuable enterprise assets for future exploitation.

Because Quick Assist is a legitimate Microsoft application commonly used by IT departments, many endpoint protection solutions and users do not initially perceive the activity as suspicious, increasing the effectiveness of the attack.

ThreatLabz identified a previously undocumented Go-based malware family called GoGRPC, which functions as a stealthy backdoor designed to provide long-term remote access. Researchers identified four distinct variants of the malware, Lep, Giver, Pet, and Kind, that evolved between January and June 2026.

Although the variants share a common architecture, later versions introduce stronger code obfuscation, encrypted communications, and enhanced techniques intended to evade security monitoring while specifically targeting enterprise environments.

After execution, GoGRPC establishes persistence by creating a Windows Registry Run key, ensuring the malware automatically launches whenever the user logs into the affected system.

Earlier variants also generated execution logs within the ProgramData directory, used Windows mutexes to prevent multiple infections, and modified file attributes to conceal malicious components.

These persistence mechanisms enable attackers to retain access even after system reboots while reducing the likelihood of detection during routine administrative activities.

The Lep and Giver variants actively fingerprint compromised systems by collecting extensive host information, including Windows version, hostname, username, Active Directory domain, processor architecture, and machine GUID.

This information is transmitted to the attackers’ command-and-control (C2) infrastructure to uniquely identify each compromised endpoint and help operators prioritize valuable targets.

Later variants, Pet and Kind, reduce visible fingerprinting activity while introducing more sophisticated code obfuscation and Transport Layer Security (TLS) encryption to better conceal malicious network communications.

One of the campaign’s most technically significant features is its use of gRPC over HTTP/2 for command-and-control communications.

Unlike traditional malware that often relies on standard HTTP requests or custom TCP protocols, GoGRPC leverages Google’s Remote Procedure Call (gRPC) framework, allowing malicious traffic to closely resemble legitimate enterprise application communications.

Earlier malware samples communicated over TCP port 443 without encryption, while newer versions encrypt traffic using TLS, making network detection significantly more challenging.

The Kind variant further complicates analysis by obfuscating its gRPC protocol definitions and modifying C2 endpoint structures to hinder reverse engineering efforts.

In addition to the GoGRPC backdoor, researchers observed attackers deploying multiple reverse proxy utilities that provide remote access to internal systems through compromised endpoints.

These tools enable lateral movement across corporate networks, credential theft, privilege escalation, and preparation for potential ransomware deployment.

Such capabilities reinforce the growing role of Initial Access Brokers within the cybercriminal ecosystem, where compromised environments are frequently monetized by selling access to ransomware affiliates rather than conducting attacks directly.

Zscaler has released indicators of compromise (IOCs), including SHA-256 hashes associated with the Giver and Lep GoGRPC variants, while intentionally defanging related IP addresses and domains to prevent accidental interaction with malicious infrastructure.

Security teams are advised to validate suspicious indicators only within controlled threat intelligence platforms such as MISP, VirusTotal, or enterprise SIEM environments.

The campaign serves as another reminder that trusted remote support applications can become powerful attack vectors when combined with convincing social engineering.

Organizations should strengthen user awareness training, implement multi-factor authentication, restrict unauthorized use of remote assistance tools, monitor PowerShell activity, and deploy behavioral detection capabilities capable of identifying unusual Quick Assist sessions.

As attackers increasingly abuse legitimate enterprise software to evade detection, proactive monitoring and layered defenses remain essential for protecting modern corporate environments against advanced intrusion campaigns.