Harvester Expands GoGra Backdoor to Linux, Using Outlook for C2
Summary
Researchers linked Harvester’s Linux GoGra backdoor to its Windows variant through shared code and typos. It uses Microsoft Graph and Outlook for C2; researchers reported no observed victims in this activity.
Key points
- A Go dropper deploys an i386 Linux implant that persists through a systemd user unit and an XDG autostart entry disguised as Conky.
- The backdoor uses hardcoded Azure AD application credentials to obtain OAuth2 tokens and poll an Outlook mailbox through Microsoft Graph.
- It decrypts tasking with AES-CBC, executes commands through /bin/bash -c, and emails encrypted results to the operator.
- The implant deletes the original tasking message after sending results.
- Researchers linked the Linux and Windows GoGra variants through a nearly identical codebase and matching spelling errors.
- Researchers reported no observed victims; initial VirusTotal submissions came from India and Afghanistan, which the article presents as an indication of regional targeting.
Article Details
- Attack Vectors
- Social-engineering lures use tailored decoy documents to induce users to execute malicious Linux ELF files disguised with document-like filenames.
- A Go dropper deploys the GoGra Linux backdoor, which establishes persistence through a systemd user unit and an XDG autostart entry.
- GoGra uses hardcoded Azure AD application credentials to access Microsoft Graph API and poll an Outlook mailbox for encrypted tasking.
- The backdoor executes received commands via /bin/bash -c, emails encrypted results to the operator, and deletes the original tasking message.
- Defensive Notes
- The article directs readers to the Symantec Protection Bulletin for the latest protection updates; it provides no specific mitigation steps.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 2d0177a00bed31f72b48965bee34cec04cb5be8eeea66ae0bb144f77e4d439b1 | Hash identified in the article for the GoGra Linux backdoor. |
| SHA256 | 57cd5721bae65c29e58121b5a9b00487a83b6c37dded56052cab2a67f90ea943 | Hash identified for TheExternalAffairesMinister.zip, an archive containing the GoGra Linux backdoor. |
| SHA256 | 74ac41406ce7a7aa992f68b4b3042f980027526f33ec6c8d84cb26f20495c9dc | Hash identified in the article for the GoGra Linux backdoor. |
| SHA256 | 9c23c65a8a392a3fd885496a5ff2004252f1ad4388814b20e5459695280b0b82 | Hash identified in the article for the GoGra Linux backdoor. |
| SHA256 | d8d84eaba9b902045ae4fe044e9761ad0ce9051b85feea3f1cf9c80b59b2b123 | Hash identified for a ZIP file containing the GoGra Linux backdoor. |
MITRE ATT&CK
T1036 · MasqueradingMalicious ELF files are disguised as documents using filenames with a space before a document-like extension, such as “TheExternalAffairesMinister. pdf”.T1041 · Exfiltration Over C2 ChannelThe implant sends AES-encrypted execution results to the operator by email through its C2 channel.T1059.004 · Unix ShellGoGra executes received commands on the host via /bin/bash -c.T1078 · Valid AccountsThe implant contains hardcoded Azure AD application credentials and uses them to request OAuth2 tokens for Graph API access.T1102 · Web ServiceThe implant uses Microsoft Graph API and Outlook mailboxes as a covert C2 channel, polling a mailbox folder for tasking.T1204 · User ExecutionTailored social-engineering decoys are used to induce victims to execute the malicious payload.T1547 · Boot or Logon Autostart ExecutionThe implant establishes startup persistence with a systemd user unit and an XDG autostart entry.
Threat Actors
Malware
GoGraHarvester has developed a new Linux variant of its GoGra backdoor that abuses the Microsoft Graph API and Outlook mailboxes as a covert C2 channel, using hardcoded Azure AD application credentials to poll mailboxes andGraphonOne of its tools is a custom backdoor called Graphon, which has similarities with GoGra and also uses Microsoft infrastructure for its C2 activity.
Vendors
Products
Azure ADthat abuses the Microsoft Graph API and Outlook mailboxes as a covert C2 channel, using hardcoded Azure AD application credentials to poll mailboxes and execute AES-encrypted tasks.Microsoft GraphHarvester has developed a new Linux variant of its GoGra backdoor that abuses the Microsoft Graph API and Outlook mailboxes as a covert C2 channel, using hardcoded Azure AD application credentials to poll mailboxes andOutlookHarvester has developed a new Linux variant of its GoGra backdoor that abuses the Microsoft Graph API and Outlook mailboxes as a covert C2 channel, using hardcoded Azure AD application credentials to poll mailboxes and