Harvester APT Expands Toolset with GoGra Linux Backdoor Abusing Microsoft Graph API for Covert C2
Harvester APT Expands Toolset with GoGra Linux Backdoor (TL-2026-0410), also tracked as GoGra-Linux, is a high-severity malware campaign scored CVSS 7.8, first published 2026-04-22. It is attributed to Harvester with high confidence, affects Linux x86_64 Linux hosts (kernel 4.18+), maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0410
- Threat ID
- TL-2026-0410
- Also known as
- GoGra-Linux, GoGra/L, Harvester Linux Implant
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-04-22
- Last reviewed
- 2026-04-22
- Attribution
- Harvester
- Attribution confidence
- HIGH
- Motivation
- ESPIONAGE
- Target sectors
- telecommunications, government, information-technology, defense, diplomatic
- Target regions
- South Asia, India, Afghanistan, Pakistan, Bangladesh
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Harvester APT Expands Toolset with GoGra Linux Backdoor
Malware and tooling: GoGra, GoGra-Linux, Go 1.22 statically-linked compiler toolchain
Symantec Threat Hunter Team reports the South Asia-focused Harvester APT has ported its GoGra backdoor to Linux, using hardcoded Azure AD OAuth2 credentials to authenticate to the Microsoft Graph API and poll an Outlook mailbox folder ('Zomato Pizza') for AES-CBC encrypted commands delivered in emails with subject 'Input'. Results are returned as 'Output' replies, giving operators a fully bidirectional, cloud-resident C2 channel that blends with legitimate Office 365 traffic. Active campaigns target telecommunications, government, and IT organizations in India and Afghanistan.
How Harvester APT Expands Toolset with GoGra Linux Backdoor works
Harvester is a South Asia-focused cyberespionage group first documented publicly by Symantec in October 2021 after intrusions into telecommunications, government, and IT organizations across Afghanistan, India, and surrounding countries. The group historically relied on a custom .NET loader (Graphon), Cobalt Strike, and the Go-based GoGra backdoor, distinguishing itself by its disciplined use of trusted cloud services — Microsoft Graph API, OneDrive, and Azure-hosted infrastructure — for command-and-control, a technique frequently categorised as 'living-off-trusted-clouds.'
On 22 April 2026 the Symantec Threat Hunter Team and BleepingComputer jointly disclosed a previously undocumented Linux variant of the GoGra implant observed in intrusions at a major Indian telecommunications provider and two Afghan government ministries. The malware is a statically-linked ELF64 binary written in Go 1.22, masquerading as 'systemd-resolvelog' and deployed under /usr/local/bin with a companion systemd service unit for persistence. Earlier artefacts were also recovered from compromised hosts using cron entries scheduled every 15 minutes.
At runtime GoGra-Linux reads a hardcoded Azure AD tenant identifier, application (client) identifier and refresh token from its .rodata section and performs an OAuth2 refresh-token grant against login.microsoftonline.com to obtain an access token scoped to Mail.ReadWrite and Mail.Send. It then issues OData queries against graph.microsoft.com/v1.0/me/mailFolders, enumerating a hidden folder named 'Zomato Pizza' and retrieving unread messages with subject 'Input'. The body of each such message contains a Base64-wrapped AES-CBC ciphertext; the key and IV are derived from a constant 32-byte secret baked into the binary, XOR-mixed with a per-message 8-byte salt carried in the first line of the message body. Decrypted payloads support eight commands including shell execution, file upload/download, persistence reconfiguration, and self-deletion.
Results are returned as a reply email with subject 'Output' to the same mailbox; the 'Zomato Pizza' folder acts as both inbox and dead-drop. Because every hop of the channel is TLS-protected traffic to legitimate Microsoft endpoints, network defenders who rely on domain reputation or TLS-SNI blocking alone cannot distinguish the C2 from ordinary Office 365 traffic. Detection therefore hinges on endpoint behavioural telemetry (Linux auditd, eBPF, EDR), anomalous Graph API app-consent patterns in Entra ID sign-in logs, and correlation of outlook-on-linux-server behaviour with host-based indicators.
Symantec assesses with high confidence that the intrusions are the work of Harvester based on code lineage with earlier Windows GoGra samples (identical Go package structure, shared AES constants, and overlap in operator mailbox naming conventions). The campaign represents the first publicly-reported Linux implementation of a Graph-API-resident C2 channel by a state-aligned actor and has immediate implications for organisations relying on Linux edge infrastructure (VPN concentrators, telco billing platforms, mail gateways) in regions of Harvester interest.
MITRE ATT&CK techniques used in TL-2026-0410
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1132 Data Encoding; T1573 Encrypted Channel
Initial Access
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Credential Access
defense-impairment
Affected products and versions in Harvester APT Expands Toolset with GoGra Linux Backdoor
- Linux — x86_64 Linux hosts (kernel 4.18+)
Vulnerable versions: RHEL 8; RHEL 9; Ubuntu 20.04; Ubuntu 22.04; Debian 11; Debian 12 - Microsoft — Microsoft Graph API / Exchange Online mailboxes (abused, not vulnerable)
Vulnerable versions: Graph v1.0 endpoints; Exchange Online via Graph mail APIs - Microsoft — Entra ID (formerly Azure AD) application registrations
Vulnerable versions: Tenants permitting refresh-token grant for Mail.ReadWrite without Conditional Access
Remediation for Harvester APT Expands Toolset with GoGra Linux Backdoor
Immediate actions
- Hunt for ELF binaries in /usr/local/bin/ and /opt/ with suspicious systemd unit files created within the last 90 days
- Block outbound graph.microsoft.com traffic from Linux hosts that have no legitimate Office 365 workload
- Rotate and revoke any Azure AD app registrations with unexplained Mail.ReadWrite / Mail.Send delegated or application permissions
- Review Entra ID sign-in logs for non-interactive OAuth2 refresh-token grants from server-class IP ranges
- Deploy provided YARA and Sigma rules to EDR and log analytics pipelines
Workarounds
- Disable legacy refresh-token flows for high-privilege Graph scopes via Entra ID authentication methods policy
- Deny egress to *.microsoftonline.com and graph.microsoft.com from workloads with no documented cloud-integration purpose
Longer-term hardening
- Enforce Conditional Access policies that restrict Graph API access by device compliance and named location
- Move all server-to-Graph integrations to managed identities; prohibit user-delegated refresh tokens on Linux servers
- Implement eBPF-based outbound TLS SNI logging on all Linux edge infrastructure
- Subscribe compromised mailboxes to Microsoft Defender for Office 365 mailbox intelligence and alert on new folder creation by service principals
- Baseline normal Graph API usage per service principal and alert on deviations (new folders, unusual ODATA filters)
Weaknesses (CWE) in Harvester APT Expands Toolset with GoGra Linux Backdoor
CWE-798, CWE-522, CWE-319, CWE-506
Timeline of Harvester APT Expands Toolset with GoGra Linux Backdoor
- Symantec publicly documents the Harvester APT after detecting intrusions into telecommunications, government, and IT targets across Afghanistan and South Asia using custom tooling and Cobalt Strike.
- Symantec publishes analysis of the original Windows GoGra backdoor alongside Firefly and Grimplant, attributing it to a South-Asia-focused cluster and highlighting Microsoft Graph API abuse.
- Initial ELF samples with overlapping Go package structure recovered from incident response engagement at an Indian telecommunications provider; at the time attribution was not public.
- Symantec telemetry confirms ongoing Linux GoGra activity across multiple Indian and Afghan targets, including two government ministries and a regional telco.
- Analysts enumerate the attacker's Azure AD tenant and mailbox infrastructure via shared client IDs and the distinctive 'Zomato Pizza' operator folder naming convention.
- Symantec coordinates disclosure with Microsoft Threat Intelligence Center, resulting in revocation of identified attacker app registrations and mailbox takedowns.
- Threadlinqs Intelligence ingests the disclosure as TL-2026-0410 and begins detection, simulation, and correlation workflows.
- Symantec Threat Hunter Team publishes the Linux GoGra analysis; BleepingComputer publishes companion coverage the same day.
- As of 2026-05-29, this remains an active threat: Harvester is a state-aligned South Asia espionage APT active since 2021, and Symantec's 22 Apr 2026 disclosure frames it as actively expanding its cross-platform GoGra toolset with no arrests, disruption, or successor reported. There are no CVEs; the Graph-API/Outlook C2 abuses legitimate Microsoft services, so the technique stays fully viable.
Sources cited for Harvester APT Expands Toolset with GoGra Linux Backdoor
- Harvester: APT Group Expands Toolset With New GoGra Linux Backdoor
- New GoGra malware for Linux uses Microsoft Graph API for comms
- MITRE ATT&CK T1102.002 - Bidirectional Communication (Web Services)
- MITRE ATT&CK T1078.004 - Valid Accounts: Cloud Accounts
- MITRE ATT&CK T1573.001 - Symmetric Cryptography
- Microsoft Graph API - Security Best Practices
- Symantec: Harvester - Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia (2021 baseline)
- Symantec: Three New Malware Families Used by China-Aligned and South-Asia-Focused Clusters (GoGra Windows disclosure)
- MITRE ATT&CK T1071.003 - Mail Protocols
- Microsoft: Conditional Access for Workload Identities
Threats related to Harvester APT Expands Toolset with GoGra Linux Backdoor
Detection coverage for TL-2026-0410
As of 2026-04-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0410 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.