Harvester APT Deploys GoGra Linux Backdoor — Microsoft Graph API Becomes the New C2 Infrastructure

TL;DR: The Harvester APT group — a nation-state-backed espionage outfit active since at least 2021 — has released a Linux port of its GoGra backdoor. The malware hides all command-and-control traffic inside Microsoft Outlook mailboxes, using legitimately-obtained Azure AD OAuth2 tokens to poll for encrypted instructions every two seconds. Traditional perimeter defenses are effectively blind to it. Initial VirusTotal submissions trace to India and Afghanistan. This is not a proof-of-concept. Harvester is actively expanding its cross-platform kill chain.

---

Background: Who Is Harvester?

Harvester is a sophisticated, nation-state-affiliated advanced persistent threat group first publicly documented by Symantec in late 2021. The group's name derives from its singular focus: long-duration intelligence harvesting against South Asian telecommunications, government, and IT organizations — the kind of infrastructure that carries the traffic and data intelligence agencies prize most.

Attribution has remained deliberately ambiguous in public reporting. Symantec does not name a sponsoring state. The group's operational target set — India and Afghanistan, with a notable focus on government ministries and carriers — is consistent with interests attributed to multiple state actors in the region. What is clear is that Harvester has the budget, capability, and patience of a mature intelligence program. This is not a ransomware crew. This is not a criminal operation. This is a quiet, persistent intelligence collection machine.

Since 2021, Harvester has demonstrated a consistent preference for living off legitimate infrastructure rather than standing up dedicated C2 servers that can be burned by threat intelligence feeds. Its original custom implant, the Graphon backdoor, already used Microsoft Graph API as a covert C2 channel — a pattern the group has now expanded and ported to Linux.

The April 2026 discovery of a Linux GoGra variant signals two things: Harvester is broadening its targeting beyond Windows-dominant government workstations into Linux-based server infrastructure, and the group's developers are actively maintaining a cross-platform toolset with a shared code lineage.

---

The GoGra Linux Backdoor: Technical Breakdown

Stage 1 — Initial Access via Social Engineering

Harvester's initial access technique is brutally effective in its simplicity. Victims receive spear-phishing emails containing malicious attachments. The filenames are carefully chosen to match regional cultural context:

• "Zomato Pizza.pdf" — Zomato is one of India's dominant food delivery platforms. A "Zomato Pizza" email in an office environment triggers zero suspicion.
• "umrah.pdf" — A reference to the Islamic pilgrimage to Mecca, calibrated for Muslim-majority audiences in Afghanistan and parts of India.
• "TheExternalAffairesMinister.pdf" — A direct impersonation of Indian government correspondence.
• "Details Format.pdf" — A generic administrative lure.

The sophistication here is in the file extension manipulation. The actual file is an ELF binary — a Linux executable — but the filename includes a subtle space before the extension: "Zomato Pizza. pdf". That trailing space ensures the file still executes as a Linux binary while appearing in file managers and email clients as a PDF document. It's a trivial trick that consistently defeats non-technical users and even some automated sandboxes configured to classify by extension.

Stage 2 — The Go Dropper

When the victim executes the ELF binary, a Go-based dropper performs three actions concurrently:

1. Displays a decoy document — a real PDF or ODT file is rendered to avoid raising suspicion. The user sees what they expected to see.

2. Deploys the core payload — the dropper writes an embedded ~5.9 MB i386 executable to ~/.config/systemd/user/userservice.

3. Establishes persistence — the implant registers a systemd user unit (surviving reboots) and creates an XDG autostart entry masquerading as Conky, the legitimate Linux system monitor. This is a particularly clean persistence mechanism: Conky is common on Linux desktops, runs at user login, and generates no alerts in most endpoint monitoring configurations.

Stage 3 — The GoGra Implant and Graph API C2

This is where Harvester's tradecraft becomes genuinely sophisticated.

The inner i386 implant contains hardcoded, plaintext Azure AD application credentials: a tenant ID, client ID, and client secret. These credentials represent a registered Azure application — almost certainly created using a compromised or purpose-created Microsoft account — that has been granted Mail.ReadWrite and Mail.Send permissions on a target Outlook mailbox.

The attack flow:

1. The implant authenticates to Microsoft using the hardcoded credentials, obtaining a short-lived OAuth2 token via the standard Microsoft identity platform endpoint.

2. It issues OData queries against the Microsoft Graph API at two-second intervals, targeting a specific Outlook mailbox folder named "Zomato Pizza" (mirroring the lure filename — the same regional brand).

3. It filters for incoming emails with a subject line beginning with "Input".

4. On finding a matching email, it extracts the message body, base64-decodes it, and AES-CBC-decrypts the result using a hardcoded key.

5. The decrypted payload is a shell command, executed via /bin/bash -c.

6. Execution results are AES-encrypted and base64-encoded, then sent back to the operator as a reply email with subject "Output".

7. Finally, the implant issues an HTTP DELETE request to remove the original command email — eliminating forensic evidence of the instruction.

The entire C2 channel flows over HTTPS to graph.microsoft.com — Microsoft's own infrastructure, trusted by every corporate firewall, proxy, and DLP system on the planet. There is no unusual destination IP, no suspicious domain, no custom protocol. The traffic is indistinguishable from legitimate Graph API usage by Microsoft 365 applications.

The Windows Parallel: Graphon and Cross-Platform Code Heritage

Symantec's analysis confirms a near-identical codebase between the Linux GoGra variant and the previously-documented Windows GoGra/Graphon tooling. The evidence is unambiguous:

Shared hardcoded string typos:

• json:"@odata.ontext" — missing the 'c' in "context"
• "error occured in decryption :" — misspelling of "occurred"
• "Commad Executed" — missing the 'n' in "Command"

Shared function name typos:

• ExcuteCommand — missing the 'e' in "Execute"
• DeleteingMessage — added 'ing' incorrectly

The Windows version used a mailbox folder named "Dragan Dash" — another food delivery brand, this time from Hyderabad, India. The consistent use of Indian food delivery service names as mailbox folder identifiers is a curious operational signature, possibly meaningful for attribution, possibly simply a developer in-joke that became a persistent pattern.

The same AES key is used across both variants. The same OAuth2 flow. The same two-second polling interval. This is one development team maintaining a unified codebase compiled for multiple target platforms — standard practice for mature threat actors, rare enough that it still marks a significant capability escalation for Harvester specifically.

---

Operational Significance: Why Living Off Microsoft Is So Dangerous

The broader trend Harvester exemplifies deserves direct attention. Microsoft Graph API has become the preferred covert C2 backbone for a growing class of sophisticated threat actors. The reasons are straightforward:

1. Allowlisted by default. graph.microsoft.com is on every corporate allowlist, every CDN bypass rule, every firewall trusted-site list. Blocking it would break Office 365, Teams, SharePoint, OneDrive, and dozens of enterprise SaaS integrations simultaneously.

2. TLS-encrypted. All Graph API traffic is HTTPS. Without SSL inspection (which many organizations exempt from Microsoft domains for performance), the content is opaque to network security tools.

3. High volume of legitimate look-alike traffic. Organizations generate massive volumes of Graph API calls every day. A backdoor polling at two-second intervals generates roughly 43,200 API calls per day — lost in the noise of a typical M365 deployment.

4. OAuth2 tokens are short-lived but auto-renewed. The malware's use of a client secret enables continuous token refresh without human re-authentication. The C2 channel is self-sustaining.

5. Microsoft takes down abuse slowly. Reporting a malicious OAuth app to Microsoft requires evidence, a process, and time. Active campaigns often run for weeks before takedown.

This is not a unique innovation — threat actors from APT29 (Cozy Bear) to APT40 have used Graph API, OneDrive, Teams, and SharePoint for covert channels. What it represents is the democratization of this technique: Harvester is a mid-tier espionage group, not a top-five nation-state team, and they've implemented it cleanly.

---

Target Profile and Attribution Assessment

Confirmed target sectors: Telecommunications, government, IT services — South Asia (India, Afghanistan)

Attribution confidence: MODERATE — Nation-state backed. The target set and operational patience are inconsistent with criminal or hacktivist motives. The regional focus on South Asia, specifically India-Afghanistan corridors, and the use of culturally-specific lures (Zomato, umrah references, External Affairs Ministry impersonation) points to an actor with deep familiarity with both the technical and social landscape of the target region.

Possible sponsoring states (based on public reporting and operational context):

• Pakistan-aligned ISI-linked actors have historically targeted Indian government and telecommunications infrastructure
• Chinese-linked actors (e.g., APT40, APT41) maintain ongoing interest in South Asian governmental networks
• Symantec has not publicly attributed to a specific state

What Harvester is not: this is not opportunistic. The level of social engineering localization — Zomato, umrah, government ministry impersonation — requires genuine intelligence about the targets. Harvester is running deliberate collection operations, not mass phishing.

---

Indicators of Compromise (IOCs)

File Hashes (SHA-256) — GoGra Linux Backdoor

| Hash | Description |

|------|-------------|

| 9c23c65a8a392a3fd885496a5ff2004252f1ad4388814b20e5459695280b0b82 | GoGra Linux Backdoor (ELF i386) |

| 2d0177a00bed31f72b48965bee34cec04cb5be8eeea66ae0bb144f77e4d439b1 | GoGra Linux Backdoor (ELF i386) |

| 74ac41406ce7a7aa992f68b4b3042f980027526f33ec6c8d84cb26f20495c9dc | GoGra Linux Backdoor (ELF i386) |

| 57cd5721bae65c... | GoGra Linux Backdoor (dropper stage) |

Persistence Artifacts

| Artifact | Path | Notes |

|----------|------|-------|

| Userservice binary | ~/.config/systemd/user/userservice | Core implant |

| Systemd unit | ~/.config/systemd/user/*.service | Reboot persistence |

| XDG autostart | ~/.config/autostart/*.desktop | Masquerades as Conky |

Behavioral IOCs

| Indicator | Detail |

|-----------|--------|

| Process masquerade | ELF binary presenting as Conky system monitor |

| Network destination | graph.microsoft.com (Microsoft Graph API) — mailbox polling at 2s intervals |

| Outlook folder names | "Zomato Pizza" (Linux), "Dragan Dash" (Windows) |

| Email subject patterns | Incoming: Input* / Outgoing: Output |

| Encryption | AES-CBC with shared hardcoded key |

| Evidence destruction | HTTP DELETE on processed command emails |

| Code typos | ExcuteCommand, DeleteingMessage, @odata.ontext, "error occured" |

File Lure Names (Social Engineering)

• Zomato Pizza. pdf (note trailing space before extension)
• umrah.pdf
• TheExternalAffairesMinister. pdf
• Details Format. pdf

---

Lyrie Take

Harvester is a preview of where enterprise espionage is going. The attack surface is no longer a vulnerable server — it's your Microsoft tenant, your Outlook mailboxes, your OAuth app registry. Every enterprise in the world trusts Graph API traffic. That trust is now a weapon.

The cross-platform expansion is the real signal here. Harvester spent years on Windows. The decision to invest engineering resources in a Linux port targeting server infrastructure means the group is leveling up — going after the hosts that actually run the data pipelines and network equipment in government and telco environments.

For Lyrie, this underscores a core truth that we build everything around: static IOC feeds are dead weight against this class of threat. By the time a hash reaches a blocklist, Harvester has already rotated the binary. What matters is behavioral detection:

• OAuth app registrations from unexpected tenants polling Graph API at machine-speed intervals
• Processes on Linux endpoints masquerading as system monitors with unusual network behavior
• Systemd user units created outside of standard software installation flows
• Email DELETE API calls immediately following automated-pattern email reads

These are behavioral signals that Lyrie's autonomous detection layer is built to surface in seconds, not weeks. Against an adversary that hides in Microsoft's own infrastructure, you need a system that watches the behavior, not the address.

---

Defender Playbook

1. Audit OAuth App Registrations

Review Azure AD → App Registrations for apps with Mail.ReadWrite or Mail.Send permissions. Flag any apps not explicitly provisioned by IT. Require admin consent for these permission scopes.

2. Enable Microsoft Purview / Entra ID Anomaly Detection

Enable sign-in risk policies and flag OAuth token issuances to applications with unusually high API polling rates. Microsoft Defender for Cloud Apps (MDCA) has Graph API behavioral baselines.

3. Monitor Systemd User Units on Linux Endpoints

Alert on creation of new ~/.config/systemd/user/*.service files, especially those pointing to executables in hidden directories (.config/, .local/, etc.). File integrity monitoring (FIM) on these paths is critical.

4. Block or Inspect i386 ELF Binaries on x86_64 Systems

Most modern Linux servers and workstations have no legitimate reason to execute 32-bit i386 binaries. Alert or block ELF i386 execution in EDR policies.

5. Sandbox ELF Files Disguised as Documents

Email security gateways should extract and analyze ELF files regardless of filename extension. The trailing-space extension trick is a known technique — any gateway doing extension-based classification without MIME sniffing will miss it.

6. Hunt on the Typos

YARA and memory scanning rules on the known function name typos (ExcuteCommand, DeleteingMessage) are reliable cross-variant detections as long as the same developer maintains the codebase.

7. Zero Trust OAuth

Implement OAuth app allow-listing via Conditional Access policies. Only explicitly approved apps should be permitted to access mailbox data — and none of them should be doing it from a new token every two seconds.

---

Sources

1. Symantec Threat Hunter Team / Broadcom Security: "Harvester: APT Group Expands Toolset With New GoGra Linux Backdoor" — security.com, April 22, 2026

2. BleepingComputer: "New GoGra malware for Linux uses Microsoft Graph API for comms" — April 22, 2026

3. HackRead: "Harvester APT Expands Spying Operations with New GoGra Linux Malware" — April 23, 2026

4. The Hacker News: "Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API" — April 22, 2026

5. Symantec: "Harvester Group Targeting Asia with Targeted Attacks" (original 2021 report) — broadcom.com

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk