Hackers Use Outlook Mailboxes to Hide Linux GoGra Backdoor Communications

A nation-state–linked APT known as Harvester has developed a Linux GoGra backdoor that abuses Microsoft Graph and real Outlook mailboxes (folder named "Zomato Pizza") as a covert C2 channel; the malware uses hardcoded Azure AD app credentials to obtain OAuth2 tokens, polls for emails with subjects starting with "Input", executes AES-CBC encrypted commands, returns encrypted results as "Output" emails, and deletes command messages to hide activity. Initial access was via social-engineering lures delivering ELF binaries masquerading as PDFs, with persistence through a systemd user unit and XDG autostart entry, and initial samples observed from India and Afghanistan indicating South Asia targeting.