# Harvester APT Deploys New Linux Variant of GoGra (Backdoor.Gogra) Backdoor Abusing Microsoft Graph API and Outlook Mailboxes for Command-and-Control

> Symantec's Threat Hunter Team attributed a new Linux variant of the GoGra backdoor to the nation-state-backed Harvester APT group. The implant abuses the legitimate Microsoft Graph API and an attacker-controlled Outlook mailbox folder for covert command-and-control, polling for 'Input'-subject tasking emails, executing Base64/AES-decrypted shell commands via /bin/bash, and returning results in 'Output'-subject emails. The Linux and Windows variants share a near-identical Go codebase, the same AES key, and the same hardcoded typos, evidencing coordinated cross-platform development.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0756
- **ID:** TL-2026-0756
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Harvester
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In April 2026, Symantec's Threat Hunter Team (Broadcom) disclosed a previously undocumented Linux variant of the GoGra backdoor (Symantec detection family Backdoor.Gogra) and attributed it to Harvester, a nation-state-backed espionage group active against South Asian targets since at least June 2021. GoGra is a Go-language implant whose defining tradecraft is the abuse of legitimate Microsoft cloud infrastructure for command-and-control: instead of contacting attacker-owned servers, the backdoor authenticates to Microsoft Entra ID (Azure AD) using hardcoded application credentials (tenant ID, client ID, client secret), obtains an OAuth2 access token, and then uses the Microsoft Graph API to read and write email in a specific Outlook mailbox folder. Because all traffic terminates at Microsoft's own graph.microsoft.com and login.microsoftonline.com endpoints over TLS, the channel blends into normal enterprise cloud usage and bypasses traditional perimeter and network-based detection.

The Linux variant polls a mailbox folder named 'Zomato Pizza' approximately every two seconds using OData ($filter/$search) queries, scanning for messages whose subject line begins with the word 'Input.' When a matching message arrives, GoGra extracts the message body, Base64-decodes it, decrypts it with a hardcoded AES-CBC key (b14ca5898a4e4133bbce2ea2315a1916), and executes the resulting string as a shell command through /bin/bash -c. Command output is AES-encrypted, Base64-wrapped, and sent back to the operator as a new email whose subject begins with 'Output,' after which the backdoor issues an HTTP DELETE via Graph to remove the original tasking message and cover its tracks. The Windows variant behaves identically but polls a folder named 'Dragan Dash' at roughly five-minute intervals, consistent with a noisier-but-faster posture on Linux versus a stealthier cadence on Windows.

Delivery is via social-engineering lures: ELF binaries disguised as PDF documents (extension spoofing using a space before '.pdf'), packaged in ZIP archives with region-relevant decoy filenames such as 'TheExternalAffairesMinister.pdf', 'umrah.pdf' and 'Details Format.pdf'. The dropper is an x86-64 ELF that drops and launches an ~5.9 MB i386 payload, writes a persistence artifact to ~/.config/systemd/user/userservice (a user-scoped systemd service named to masquerade as a legitimate component), and masquerades as the legitimate 'Conky' Linux system monitor. The Linux and Windows builds share a single developer fingerprint: identical hardcoded spelling errors ('error occured in decryption', 'Commad Executed'), the malformed JSON tag json:"@odata.ontext", function-name typos ExcuteCommand and DeleteingMessage, and the same AES key. The internal Go package paths differ only by name (OUTLOOKCLIENT/services on Linux, NEWCLIENT/services on Windows). GoGra is the spiritual successor to Harvester's earlier Graphon backdoor (first documented by Symantec in 2021), which pioneered the group's Microsoft Graph API C2 technique; the Windows GoGra was first reported in August 2024 against a South Asian media organization, and this Linux port extends the same capability to Unix server estates. Samples uploaded to VirusTotal originated from India and Afghanistan, indicating those countries as likely targets of the espionage campaign.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Harvester: APT Group Expands Toolset With New GoGra Linux Backdoor](https://www.security.com/threat-intelligence/harvester-new-linux-backdoor-gogra)
- [Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API](https://thehackernews.com/2026/04/harvester-deploys-linux-gogra-backdoor.html)
- [New GoGra malware for Linux uses Microsoft Graph API for comms](https://www.bleepingcomputer.com/news/security/new-gogra-malware-for-linux-uses-microsoft-graph-api-for-comms/)
- [Microsoft Graph API misused by new GoGra Linux malware for hidden communication](https://securityaffairs.com/191153/malware/microsoft-graph-api-misused-by-new-gogra-linux-malware-for-hidden-communication.html)
- [Harvester APT Expands Spying Operations with New GoGra Linux Malware](https://hackread.com/harvester-apt-spying-new-gogra-linux-malware/)
- [GoGra backdoor targets Linux, abuses Microsoft Graph API for stealthy attacks](https://www.scworld.com/brief/gogra-backdoor-targets-linux-abuses-microsoft-graph-api-for-stealthy-attacks)
- [Harvester APT Uses GoGra Linux Backdoor And Microsoft Graph API For Stealthy Outlook C2](https://cybersecurefox.com/en/harvester-gogra-linux-backdoor-microsoft-graph-outlook-c2/)
- [GoGra Linux Malware Controlled via Microsoft Graph and Outlook](https://www.it-connect.tech/gogra-linux-malware-controlled-via-microsoft-graph-and-outlook/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0756