Linux GoGra Backdoor Uses Microsoft Graph for Outlook-Based Command and Control
Summary
Symantec researchers report that Linux GoGra uses hardcoded Azure AD credentials and Outlook via Microsoft Graph for command-and-control, with systemd/XDG persistence and encrypted command execution; code similarities link it to Harvester.
Key points
- Symantec researchers analyzed Linux GoGra samples and report that initial access involves ELF binaries disguised as PDFs.
- A Go-based dropper deploys an i386 payload, which persists through systemd and an XDG autostart entry disguised as Conky.
- The backdoor uses hardcoded Azure AD credentials and Microsoft Graph to access an Outlook mailbox.
- It polls the “Zomato Pizza” folder for emails with subjects beginning “Input,” decrypts their commands, and executes them locally.
- GoGra returns AES-encrypted results in reply emails with the subject “Output,” then deletes the original command emails.
- Researchers link the Linux and Windows samples to the same developer—and point to Harvester—based on near-identical code, matching typos, and the same AES key.
Article Details
- Attack Vectors
- Victims are tricked into executing ELF binaries disguised as PDF files; a Go-based dropper then deploys an i386 payload.
- The malware uses hardcoded Azure Active Directory credentials and Microsoft Graph API to access an Outlook mailbox, retrieve commands, and return results.
- The malware establishes persistence through systemd and an XDG autostart entry that masquerades as Conky.
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe XDG autostart entry poses as the legitimate Conky system monitor.T1070.008 · Clear Mailbox DataAfter processing a command, the malware sends an HTTP DELETE request to remove the original email.T1102.002 · Bidirectional CommunicationGoGra uses Microsoft Graph API and an Outlook mailbox for two-way command delivery and results.T1140 · Deobfuscate/Decode Files or InformationThe malware base64-decodes and AES-CBC-decrypts command contents retrieved from mailbox messages.T1204.002 · Malicious FileInitial access reportedly involves tricking victims into executing ELF binaries disguised as PDF files.T1543.002 · Systemd ServiceThe malware establishes persistence through systemd.T1547.013 · XDG Autostart EntriesThe malware establishes persistence through an XDG autostart entry.T1552.001 · Credentials In FilesThe GoGra variant uses hardcoded Azure Active Directory credentials to authenticate to Microsoft's cloud.
Threat Actors
Malware
Vendors
Products
Azure ADIn a report today, Symantec researchers say that the Linux version of the GoGra backdoor uses hardcoded Azure Active Directory (AD) credentials to authenticate to Microsoft’s cloud and obtain OAuth2 tokens.ConkyPersistence is achieved through systemd and an XDG autostart entry masquerading as the Conky system monitor.Microsoft GraphSymantec researchers found a Linux variant of the GoGra backdoor that uses hardcoded Azure AD credentials and the Microsoft Graph API to stealthily pull commands from an Outlook mailbox.OutlookSymantec researchers found a Linux variant of the GoGra backdoor that uses hardcoded Azure AD credentials and the Microsoft Graph API to stealthily pull commands from an Outlook mailbox.
Industries
GovernmentNearly identical code, typos, and AES key link the Linux and Windows GoGra samples to the Harvester espionage group targeting South Asian telecom, government, and IT organizations.TelecommunicationsHarvester has been active since at least 2021 and is known to use custom malicious tools, such as backdoors and loaders in campaigns targeting telecommunications, government, and IT organizations in South Asia.