GoGRPC Backdoor & Teams Vishing Campaign: Helpdesk Hijacker IAB Tactics — OTX Pulse Analysis

title: Potential Microsoft Quick Assist Abuse
id: 8a7b6c5d-4e3f-2a1b-9c8d-7e6f5a4b3c21
description: Detects Microsoft Quick Assist (msra.exe) spawning a shell process, indicative of a social engineering attack leading to code execution.
status: experimental
author: Security Arsenal
date: 2026/07/28
references:
    - https://www.zscaler.com/blogs/security-research/helpdesk-hijackers-teams-vishing-quick-assist-and-gogrpc-backdoor
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\msra.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate IT support using Quick Assist for command line tasks
level: high
---
title: Microsoft Teams Initiating Quick Assist Session
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects Microsoft Teams spawning the Quick Assist executable, a common vector in vishing campaigns where attackers pose as IT support.
status: experimental
author: Security Arsenal
date: 2026/07/28
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Teams.exe'
        Image|endswith: '\msra.exe'
    condition: selection
falsepositives:
    - Legitimate internal support calls using Teams
level: medium
---
title: GoGRPC Backdoor Network Traffic
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
description: Detects potential network activity associated with GoGRPC backdoor C2 infrastructure based on observed IOCs and port usage.
status: experimental
author: Security Arsenal
date: 2026/07/28
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|contains:
            - '94.140.114.192'
            - '45.86.162.228'
            - '5.253.59.222'
        DestinationPort:
            - 443
            - 80
    condition: selection
falsepositives:
    - Unknown
level: critical


**KQL (Microsoft Sentinel)**
kql
// Hunt for suspicious process chains involving Quick Assist and PowerShell
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "msra.exe" and ProcessFileName in ("powershell.exe", "cmd.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath
| extend HuntContext = "Potential Quick Assist Abuse"
| join kind=inner (
    DeviceNetworkEvents
    | where RemoteIP in ("94.140.114.192", "45.86.162.228", "5.253.59.222") or RemoteUrl contains "scansec-upd.com"
) on DeviceName, Timestamp


**PowerShell Hunt Script**
powershell
# IOC Hunter for GoGRPC / Helpdesk Hijacker Campaign
$MD5Hashes = @(
    "3d1819de80c5a6633bc546f7b07086a4",
    "7a818efa2a3af3130a3c4b69260a08aa",
    "925dc63fc70de650127f41e00e9ffbf3",
    "b42366dcf2612adb43ed0c617bfa98d4"
)

Write-Host "[+] Scanning for GoGRPC Backdoor Artifacts..." -ForegroundColor Cyan

# Check running processes
Get-Process | Where-Object {
    try {
        $hash = (Get-FileHash -Path $_.Path -Algorithm MD5 -ErrorAction Stop).Hash
        $hash -in $MD5Hashes
    } catch { $false }
} | Select-Object ProcessName, Id, Path

# Check common download directories
$Paths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\ProgramData")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Write-Host "[+] Scanning $Path..." -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $fileHash = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash
            if ($MD5Hashes -contains $fileHash) {
                Write-Host "[!] MALICIOUS FILE DETECTED: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}