Executive Summary
Since January 2026, Zscaler ThreatLabz has tracked a threat actor, potentially the 'Payouts King' initial access broker, utilizing sophisticated vishing techniques. The campaign targets corporate employees via Microsoft Teams, impersonating IT helpdesk staff to manipulate victims into establishing a remote session via Windows Quick Assist. Once access is gained, the attackers deploy a variety of tools, most notably GoGRPC, a Go-based backdoor that utilizes gRPC over HTTP/2 for command-and-control communication.
The attack chain involves initial reconnaissance followed by the deployment of specialized malware such as BlindDoor, RevSocket, and S3Siphon for data exfiltration. The actor has demonstrated rapid evolution, producing four GoGRPC variants (Lep, Giver, Pet, Kind) with increasing levels of obfuscation and TLS support. This activity is highly likely a precursor to ransomware deployment, specifically targeting sensitive corporate directories and domain information.
The business impact is significant as the actor focuses on data theft and lateral movement within corporate networks. The shift toward using legitimate protocols like gRPC and encrypted WebSockets for proxying traffic makes these intrusions difficult to detect with standard network monitoring, requiring immediate attention to remote assistance policies and helpdesk authentication procedures.