Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor
Malware Families
Excerpt
IntroductionZscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging vishing techniques through Microsoft Teams and deploying a variety of tools including a Go-based backdoor that we named GoGRPC. ThreatLabz has identified at least four variants of GoGRPC that we named Lep, Giver, Pet, and Kind. In some instances,…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | f85960dee17ba587b712cd8cdf89042bcd6ba711c3d5d548bef7c7f0988413f5 | High | Score 64/100 | First seen |
IOC Relationship Graph
Building graph…