Harvester APT Expands Toolset with GoGra Linux Backdoor Abusing Microsoft Graph API for Covert C2 — Threadlinqs Intelligence
As of 2026-05-30, Harvester APT Expands Toolset with GoGra Linux Backdoor Abusing Microsoft Graph API for Covert C2 is a high-severity malware threat attributed to Harvester (Unknown (South Asia-aligned)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0410 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: MALWARE
Attribution: Harvester · Unknown (South Asia-aligned) · ESPIONAGE
Symantec Threat Hunter Team reports the South Asia-focused Harvester APT has ported its GoGra backdoor to Linux, using hardcoded Azure AD OAuth2 credentials to authenticate to the Microsoft Graph API
Harvester is a South Asia-focused cyberespionage group first documented publicly by Symantec in October 2021 after intrusions into telecommunications, government, and IT organizations across Afghanistan, India, and surrounding countries. The group historically relied on a custom .NET loader (Graphon), Cobalt Strike, and the Go-based GoGra backdoor, distinguishing itself by its disciplined use of trusted cloud services — Microsoft Graph API, OneDrive, and Azure-hosted infrastructure — for command-and-control, a technique frequently categorised as 'living-off-trusted-clouds.'
On 22 April 2026 the Symantec Threat Hunter Team and BleepingComputer jointly disclosed a previously undocumented Linux variant of the GoGra implant observed in intrusions at a major Indian telecommunications provider and two Afghan government ministries. The malware is a statically-linked ELF64 binary written in Go 1.22, masquerading as 'systemd-resolvelog' and deployed under /usr/local/bin with a companion systemd service unit for persistence. Earlier artefacts were also recovered from compromised hosts using cron entries scheduled every 15 minutes.
At runtime GoGra-Linux reads a hardcoded Azure AD tenant identifier, application (client) identifier and refresh token from its .rodata section and performs an OAuth2 refresh-token grant against login.microsoftonline.com to obtain an access token scoped to Mail.ReadWrite and Mail.Send. It then issues OData queries against graph.microsoft.com/v1.0/me/mailFolders, enumerating a hidden folder named 'Zomato Pizza' and retrieving unread messages with subject 'Input'. The body of each such message contains a Base64-wrapped AES-CBC ciphertext; the key and IV are derived from a constant 32-byte secret baked into the binary, XOR-mixed with a per-message 8-byte salt carried in the first line of the message body. Decrypted payloads support eight commands including shell execution, file upload/download, persistence reconfiguration, and self-deletion.
Results are returned as a reply email with subject 'Output' to the same mailbox; the 'Zomato Pizza' folder acts as both inbox and dead-drop. Because every hop of the channel is TLS-protected traffic to legitimate Microsoft endpoints, network defenders who rely on domain reputation or TLS-SNI blocking alone cannot distinguish the C2 from ordinary Office 365 traffic. Detection therefore hinges on endpoint behavioural telemetry (Linux auditd, eBPF, EDR), anomalous Graph API app-consent patterns in Entra ID sign-in logs, and correlation of outlook-on-linux-server behaviour with host-based indicators.
Symantec assesses with high confidence that the intrusions are the work of Harvester based on code lineage with earlier Windows GoGra samples (identical Go package structure, shared AES constants, and overlap in operator mailbox naming conventions). The campaign represents the first publicly-reported Linux implementation of a Graph-API-resident C2 channel by a state-aligned actor and has immediate implications for organisations relying on Linux edge infrastructure (VPN concentrators, telco billing platforms, mail gateways) in regions of Harvester interest.
Weaknesses (CWE)
CWE-798, CWE-522, CWE-319, CWE-506
Target sectors: telecommunications, government, information-technology, defense, diplomatic
Target regions: South Asia, India, Afghanistan, Pakistan, Bangladesh
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1078, T1059, T1543, T1053, T1547, T1036, T1027, T1140, T1685, T1552
