# Harvester APT Expands Toolset with GoGra Linux Backdoor Abusing Microsoft Graph API for Covert C2

> Symantec Threat Hunter Team reports the South Asia-focused Harvester APT has ported its GoGra backdoor to Linux, using hardcoded Azure AD OAuth2 credentials to authenticate to the Microsoft Graph API and poll an Outlook mailbox folder ('Zomato Pizza') for AES-CBC encrypted commands delivered in emails with subject 'Input'. Results are returned as 'Output' replies, giving operators a fully bidirectional, cloud-resident C2 channel that blends with legitimate Office 365 traffic. Active campaigns target telecommunications, government, and IT organizations in India and Afghanistan.

- **Published:** 2026-04-22T12:00:00Z
- **Last reviewed:** 2026-04-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0410
- **ID:** TL-2026-0410
- **Severity:** HIGH (CVSS 7.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Harvester
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Harvester is a South Asia-focused cyberespionage group first documented publicly by Symantec in October 2021 after intrusions into telecommunications, government, and IT organizations across Afghanistan, India, and surrounding countries. The group historically relied on a custom .NET loader (Graphon), Cobalt Strike, and the Go-based GoGra backdoor, distinguishing itself by its disciplined use of trusted cloud services — Microsoft Graph API, OneDrive, and Azure-hosted infrastructure — for command-and-control, a technique frequently categorised as 'living-off-trusted-clouds.'

On 22 April 2026 the Symantec Threat Hunter Team and BleepingComputer jointly disclosed a previously undocumented Linux variant of the GoGra implant observed in intrusions at a major Indian telecommunications provider and two Afghan government ministries. The malware is a statically-linked ELF64 binary written in Go 1.22, masquerading as 'systemd-resolvelog' and deployed under /usr/local/bin with a companion systemd service unit for persistence. Earlier artefacts were also recovered from compromised hosts using cron entries scheduled every 15 minutes.

At runtime GoGra-Linux reads a hardcoded Azure AD tenant identifier, application (client) identifier and refresh token from its .rodata section and performs an OAuth2 refresh-token grant against login.microsoftonline.com to obtain an access token scoped to Mail.ReadWrite and Mail.Send. It then issues OData queries against graph.microsoft.com/v1.0/me/mailFolders, enumerating a hidden folder named 'Zomato Pizza' and retrieving unread messages with subject 'Input'. The body of each such message contains a Base64-wrapped AES-CBC ciphertext; the key and IV are derived from a constant 32-byte secret baked into the binary, XOR-mixed with a per-message 8-byte salt carried in the first line of the message body. Decrypted payloads support eight commands including shell execution, file upload/download, persistence reconfiguration, and self-deletion.

Results are returned as a reply email with subject 'Output' to the same mailbox; the 'Zomato Pizza' folder acts as both inbox and dead-drop. Because every hop of the channel is TLS-protected traffic to legitimate Microsoft endpoints, network defenders who rely on domain reputation or TLS-SNI blocking alone cannot distinguish the C2 from ordinary Office 365 traffic. Detection therefore hinges on endpoint behavioural telemetry (Linux auditd, eBPF, EDR), anomalous Graph API app-consent patterns in Entra ID sign-in logs, and correlation of outlook-on-linux-server behaviour with host-based indicators.

Symantec assesses with high confidence that the intrusions are the work of Harvester based on code lineage with earlier Windows GoGra samples (identical Go package structure, shared AES constants, and overlap in operator mailbox naming conventions). The campaign represents the first publicly-reported Linux implementation of a Graph-API-resident C2 channel by a state-aligned actor and has immediate implications for organisations relying on Linux edge infrastructure (VPN concentrators, telco billing platforms, mail gateways) in regions of Harvester interest.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [Harvester: APT Group Expands Toolset With New GoGra Linux Backdoor](https://www.security.com/threat-intelligence/harvester-new-linux-backdoor-gogra)
- [New GoGra malware for Linux uses Microsoft Graph API for comms](https://www.bleepingcomputer.com/news/security/new-gogra-malware-for-linux-uses-microsoft-graph-api-for-comms/)
- [MITRE ATT&CK T1102.002 - Bidirectional Communication (Web Services)](https://attack.mitre.org/techniques/T1102/002/)
- [MITRE ATT&CK T1078.004 - Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
- [MITRE ATT&CK T1573.001 - Symmetric Cryptography](https://attack.mitre.org/techniques/T1573/001/)
- [Microsoft Graph API - Security Best Practices](https://learn.microsoft.com/en-us/graph/security-concept-overview)
- [Symantec: Harvester - Nation-State-Backed Group Uses New Toolset to Target Victims in South Asia (2021 baseline)](https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia)
- [Symantec: Three New Malware Families Used by China-Aligned and South-Asia-Focused Clusters (GoGra Windows disclosure)](https://www.security.com/threat-intelligence/gogra-firefly-grimplant)
- [MITRE ATT&CK T1071.003 - Mail Protocols](https://attack.mitre.org/techniques/T1071/003/)
- [Microsoft: Conditional Access for Workload Identities](https://learn.microsoft.com/en-us/entra/identity/conditional-access/workload-identity)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0410