Harvester Expands GoGra Backdoor to Linux, Uses Outlook for C2
Summary
Symantec and Carbon Black report that Harvester’s Linux GoGra backdoor uses Microsoft Graph and an Outlook folder for C2, executing email-delivered commands. VirusTotal artifacts from India and Afghanistan suggest, but do not confirm, South Asian targeting.
Key points
- The Linux GoGra variant is attributed to Harvester; researchers say it extends the group’s tooling beyond Windows.
- Victims are socially engineered into opening ELF binaries disguised as PDFs; a decoy document appears while the backdoor runs.
- The backdoor polls an Outlook folder named “Zomato Pizza” every two seconds through Microsoft Graph and OData queries.
- It processes messages with subjects starting “Input,” executes their Base64-encoded bodies as shell commands via /bin/bash, and emails results with the subject “Output.”
- After sending results, the implant deletes the original tasking message.
- Symantec and Carbon Black cite matching hard-coded spelling errors in the Windows and Linux tools as evidence pointing to the same developer.
- Artifacts uploaded to VirusTotal from India and Afghanistan suggest possible South Asian targeting; they do not independently confirm victimization.
Article Details
- Attack Vectors
- Social engineering tricks victims into opening ELF binaries disguised as PDF documents; a decoy document is displayed while the dropper runs the backdoor.
- The Linux GoGra backdoor polls an Outlook folder named “Zomato Pizza” through Microsoft Graph API for emails with subjects starting “Input,” then executes the decoded commands with /bin/bash.
- Command results are sent to the operator in emails titled “Output,” and the original tasking messages are deleted.
MITRE ATT&CK
T1036.008 · Masquerade File TypeThe ELF binaries are disguised as PDF documents to conceal their executable file type.T1041 · Exfiltration Over C2 ChannelThe backdoor exfiltrates command execution results to the operator in “Output” email messages over its command-and-control channel.T1059.004 · Unix ShellGoGra executes received commands using /bin/bash.T1070.008 · Clear Mailbox DataAfter sending the execution results, the implant deletes the original tasking message from the mailbox.T1071.003 · Mail ProtocolsGoGra uses Outlook email messages for command tasking and sends execution results back by email.T1102.002 · Bidirectional CommunicationThe backdoor uses Microsoft Graph API and Outlook mailboxes as a bidirectional command-and-control channel.T1204.002 · Malicious FileVictims are socially engineered into opening ELF binaries disguised as PDF documents.
Threat Actors
Malware
GoGraHarvester has deployed a new Linux variant of its GoGra backdoor that leverages the Microsoft Graph API and Outlook mailboxes as a covert C2 channel.Graphonand information technology sectors in South Asia since June 2021, using a bespoke implant called Graphon that used the Microsoft Graph API for C2.
Vendors
Products
Microsoft GraphHarvester has deployed a new Linux variant of its GoGra backdoor that leverages the Microsoft Graph API and Outlook mailboxes as a covert C2 channel.OutlookHarvester has deployed a new Linux variant of its GoGra backdoor that leverages the Microsoft Graph API and Outlook mailboxes as a covert C2 channel.
Countries
AfghanistanSymantec and Carbon Black tied artifacts to India and Afghanistan and noted the implant polls an Outlook folder named “Zomato Pizza” for Base64-encoded commands before executing them, indicating Harvester is expandingIndiaSymantec and Carbon Black tied artifacts to India and Afghanistan and noted the implant polls an Outlook folder named “Zomato Pizza” for Base64-encoded commands before executing them, indicating Harvester is expanding
Industries
Governmentby Symantec in late 2021, linking it to an information-stealing campaign aimed at telecommunications, government, and information technology sectors in South Asia since June 2021, using a bespoke implant calledInformation Technology2021, linking it to an information-stealing campaign aimed at telecommunications, government, and information technology sectors in South Asia since June 2021, using a bespoke implant called Graphon that used theMediaSubsequent activity flagged in August 2024 connected the hacking group to an attack targeting an unnamed media organization in South Asia with a never-before-seen Go-based backdoor called GoGra.Telecommunicationsdocumented by Symantec in late 2021, linking it to an information-stealing campaign aimed at telecommunications, government, and information technology sectors in South Asia since June 2021, using a bespoke