Harvester APT Deploys New Linux Variant of GoGra (Backdoor.Gogra) Backdoor Abusing Microsoft Graph API and Outlook Mailboxes for Command-and-Control
Harvester APT Deploys New Linux Variant of GoGra (TL-2026-0756), also tracked as GoGra Linux, is a high-severity malware campaign, first published 2026-06-10. It is attributed to Harvester with high confidence, affects Linux Linux server/workstation (x86-64 with i386 payload support), maps to 19 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0756
- Threat ID
- TL-2026-0756
- Also known as
- GoGra Linux, Backdoor.Gogra, Linux GoGra
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution
- Harvester
- Attribution confidence
- HIGH
- Motivation
- ESPIONAGE
- Target sectors
- telecommunications, government, information technology, media
- Target regions
- South Asia, India, Afghanistan
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Harvester APT Deploys New Linux Variant of GoGra
Malware and tooling: GoGra
Symantec's Threat Hunter Team attributed a new Linux variant of the GoGra backdoor to the nation-state-backed Harvester APT group. The implant abuses the legitimate Microsoft Graph API and an attacker-controlled Outlook mailbox folder for covert command-and-control, polling for 'Input'-subject tasking emails, executing Base64/AES-decrypted shell commands via /bin/bash, and returning results in 'Output'-subject emails. The Linux and Windows variants share a near-identical Go codebase, the same AES key, and the same hardcoded typos, evidencing coordinated cross-platform development.
How Harvester APT Deploys New Linux Variant of GoGra works
In April 2026, Symantec's Threat Hunter Team (Broadcom) disclosed a previously undocumented Linux variant of the GoGra backdoor (Symantec detection family Backdoor.Gogra) and attributed it to Harvester, a nation-state-backed espionage group active against South Asian targets since at least June 2021. GoGra is a Go-language implant whose defining tradecraft is the abuse of legitimate Microsoft cloud infrastructure for command-and-control: instead of contacting attacker-owned servers, the backdoor authenticates to Microsoft Entra ID (Azure AD) using hardcoded application credentials (tenant ID, client ID, client secret), obtains an OAuth2 access token, and then uses the Microsoft Graph API to read and write email in a specific Outlook mailbox folder. Because all traffic terminates at Microsoft's own graph.microsoft.com and login.microsoftonline.com endpoints over TLS, the channel blends into normal enterprise cloud usage and bypasses traditional perimeter and network-based detection.
The Linux variant polls a mailbox folder named 'Zomato Pizza' approximately every two seconds using OData ($filter/$search) queries, scanning for messages whose subject line begins with the word 'Input.' When a matching message arrives, GoGra extracts the message body, Base64-decodes it, decrypts it with a hardcoded AES-CBC key (b14ca5898a4e4133bbce2ea2315a1916), and executes the resulting string as a shell command through /bin/bash -c. Command output is AES-encrypted, Base64-wrapped, and sent back to the operator as a new email whose subject begins with 'Output,' after which the backdoor issues an HTTP DELETE via Graph to remove the original tasking message and cover its tracks. The Windows variant behaves identically but polls a folder named 'Dragan Dash' at roughly five-minute intervals, consistent with a noisier-but-faster posture on Linux versus a stealthier cadence on Windows.
Delivery is via social-engineering lures: ELF binaries disguised as PDF documents (extension spoofing using a space before '.pdf'), packaged in ZIP archives with region-relevant decoy filenames such as 'TheExternalAffairesMinister.pdf', 'umrah.pdf' and 'Details Format.pdf'. The dropper is an x86-64 ELF that drops and launches an ~5.9 MB i386 payload, writes a persistence artifact to ~/.config/systemd/user/userservice (a user-scoped systemd service named to masquerade as a legitimate component), and masquerades as the legitimate 'Conky' Linux system monitor. The Linux and Windows builds share a single developer fingerprint: identical hardcoded spelling errors ('error occured in decryption', 'Commad Executed'), the malformed JSON tag json:"@odata.ontext", function-name typos ExcuteCommand and DeleteingMessage, and the same AES key. The internal Go package paths differ only by name (OUTLOOKCLIENT/services on Linux, NEWCLIENT/services on Windows). GoGra is the spiritual successor to Harvester's earlier Graphon backdoor (first documented by Symantec in 2021), which pioneered the group's Microsoft Graph API C2 technique; the Windows GoGra was first reported in August 2024 against a South Asian media organization, and this Linux port extends the same capability to Unix server estates. Samples uploaded to VirusTotal originated from India and Afghanistan, indicating those countries as likely targets of the espionage campaign.
MITRE ATT&CK techniques used in TL-2026-0756
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1132 Data Encoding; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
Persistence
T1543 Create or Modify System Process
Credential Access
Initial Access
Resource Development
T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Affected products and versions in Harvester APT Deploys New Linux Variant of GoGra
- Linux — Linux server/workstation (x86-64 with i386 payload support)
Vulnerable versions: x86-64 Linux with systemd user services - Microsoft — Microsoft Graph API / Outlook (Exchange Online) mailboxes
Vulnerable versions: Abused as legitimate C2 broker via Entra ID app credentials
Remediation for Harvester APT Deploys New Linux Variant of GoGra
Immediate actions
- Hunt for the AES key constant b14ca5898a4e4133bbce2ea2315a1916 and the Go typo strings (ExcuteCommand, DeleteingMessage, @odata.ontext) across endpoint and binary telemetry
- Inspect ~/.config/systemd/user/ for unexpected user services such as 'userservice' on Linux hosts and disable/quarantine them
- Block or hashed-deny the five known SHA-256 samples at endpoint and email gateways
- Review Microsoft Entra ID sign-in and audit logs for OAuth2 token grants to unrecognized enterprise applications and for Graph API mail.read/mail.readwrite activity from server IP space
Workarounds
- Restrict outbound access from Linux servers to Microsoft 365 cloud endpoints where not operationally required
- Enforce application consent governance so rogue Azure AD app registrations cannot be used as a mailbox-based C2 broker
Longer-term hardening
- Deploy EDR with behavioral detection for ELF droppers spawning /bin/bash -c with decoded payloads and for processes masquerading as Conky/systemd user services
- Apply least-privilege and conditional-access policies to Microsoft Graph application permissions; alert on Mail.ReadWrite granted to non-mail applications
- Egress-monitor and baseline graph.microsoft.com / login.microsoftonline.com access from server workloads that have no business reason to call Graph
- Implement attachment detonation and ELF-as-PDF / double-extension detection at the mail gateway
Timeline of Harvester APT Deploys New Linux Variant of GoGra
- Harvester espionage activity against South Asian telecommunications, government and IT targets begins, later documented by Symantec in 2021 using the Graphon backdoor that pioneered Microsoft Graph API C2.
- Symantec publicly documents the Harvester group and its custom Graphon backdoor abusing the Microsoft Graph API for command-and-control, establishing the group's signature living-off-trusted-sites C2 tradecraft.
- Windows variant of GoGra (Go-language successor to Graphon) first reported, used against a media organization in South Asia, polling Outlook folder 'Dragan Dash' at ~5-minute intervals for 'Input'-subject tasking.
- Linux GoGra samples and ELF-disguised-as-PDF droppers uploaded to VirusTotal from India and Afghanistan, indicating active targeting in South Asia.
- Region-themed decoy ZIP archives (e.g. TheExternalAffairesMinister.zip) carrying ELF binaries spoofed as PDFs (umrah.pdf, Details Format.pdf) used to deliver the Linux dropper, which writes the ~/.config/systemd/user/userservice persistence artifact and masquerades as the Conky system monitor.
- The Hacker News reports the disclosure the same day, framing the Linux port as Harvester extending its Graph-API mailbox C2 capability to Unix server estates.
- Symantec's Threat Hunter Team publishes analysis attributing the new Linux GoGra variant to Harvester, detailing Microsoft Graph API / Outlook 'Zomato Pizza' folder C2, the shared AES key b14ca5898a4e4133bbce2ea2315a1916, and a near-identical codebase shared with the Windows build.
- Secondary reporting (Hackread, SC Media, CyberSecureFox) corroborates the campaign, IOCs and cross-platform code-similarity findings across the security press.
- Additional technical write-ups (IT-Connect) detail the 'Input'/'Output' email tasking convention, Base64+AES-CBC command encoding, /bin/bash -c execution and post-execution Graph DELETE track-covering.
- BleepingComputer and Security Affairs publish follow-up coverage, widening dissemination of the SHA-256 hashes and Graph-API C2 indicators to defenders.
- Threat tracked and documented in the Threadlinqs Intelligence Platform with full MITRE ATT&CK mapping, IOCs and detection coverage.
Sources cited for Harvester APT Deploys New Linux Variant of GoGra
- Harvester: APT Group Expands Toolset With New GoGra Linux Backdoor
- Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API
- New GoGra malware for Linux uses Microsoft Graph API for comms
- Microsoft Graph API misused by new GoGra Linux malware for hidden communication
- Harvester APT Expands Spying Operations with New GoGra Linux Malware
- GoGra backdoor targets Linux, abuses Microsoft Graph API for stealthy attacks
- Harvester APT Uses GoGra Linux Backdoor And Microsoft Graph API For Stealthy Outlook C2
- GoGra Linux Malware Controlled via Microsoft Graph and Outlook
Threats related to Harvester APT Deploys New Linux Variant of GoGra
Detection coverage for TL-2026-0756
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0756 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.