Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API

Back Thehackernews

Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API

Thehackernews •[email protected] (The Hacker News) • April 22, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Harvester APT Group Unveils New GoGra Linux Backdoor Using Microsoft Graph API The Harvester APT group has launched a Linux variant of its GoGra backdoor, utilizing the Microsoft Graph API and Outlook mailboxes for covert command-and-control operations. This malware is designed to evade traditional defenses and has been linked to prior Windows-based espionage campaigns by the same group. Initial VirusTotal submissions indicate that the primary targets are located in India and Afghanistan, with localized decoy documents suggesting a tailored attack strategy. The malware masquerades as legitimate files, tricking users into executing malicious ELF binaries disguised as PDFs. It employs hardcoded Azure AD credentials to authenticate and poll a specific mailbox folder named 'Zomato Pizza' for commands. The malware's persistence mechanism involves setting up a systemd user unit and an XDG autostart entry, camouflaged as the Conky system monitor. Symantec researchers have noted that the Linux variant shares significant code similarities with its Windows counterpart, indicating a unified development effort. The current status shows that while no victims have been confirmed yet, the potential for targeted attacks remains high. 9 sources 76

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)

Tools (1)

Microsoft Graph API