Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API

Source: The Hacker News

Overview

The threat actor known as Harvester has been attributed to a new Linux version of its GoGra backdoor, deployed as part of attacks likely targeting entities in South Asia.

Technical Details

The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command‑and‑control (C2) channel, allowing it to bypass traditional perimeter network defenses.

“The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel, allowing it to bypass traditional perimeter network defenses,” – Symantec and Carbon Black Threat Hunter