APT Group Expands Toolset With New GoGra Linux Backdoor

The Harvester APT group has developed a highly-evasive Linux version of its GoGra backdoor that leverages Microsoft Graph API and Outlook mailboxes as a covert command-and-control channel to bypass traditional network defenses. Initial VirusTotal submissions originated from India and Afghanistan, indicating these regions as primary targets. The attackers use social engineering with tailored decoy documents masquerading as legitimate files, including references to Indian food delivery services. The backdoor uses hardcoded Azure AD credentials to poll mailboxes every two seconds, executing commands received via email and exfiltrating results back to operators. Analysis confirms this Linux variant shares nearly identical code with a previously known Windows version, including matching spelling errors, demonstrating the group's multi-platform development strategy and continued expansion of capabilities targeting South Asia for espionage purposes.

• Harvester: APT Group Expands Toolset With New GoGra Linux BackdoorMalware2026-05-01
• One leftover build path links an infostealer, a remote-access tool, and a ransomware familyMalware2026-09-01
• ScreenConnect RMM Abuse, Cloudflare Tunnels, and Trusted Software Lures Threat Intelligence, Threat Research, Threat SecurityCampaign2026-08-04
• Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet LoaderMalware2026-07-14
• Critical SimpleHelp flaw exploited to deploy new stealer malwareExploitedMalware2026-06-29