Outlook Mailboxes Used to Conceal Linux GoGra Backdoor Traffic

A previously Windows-focused APT known as Harvester has deployed a new Linux variant of the GoGra backdoor that uses social-engineered lures and a Go-based dropper to establish persistence via systemd/XDG autostart. The backdoor authenticates to Microsoft services using hardcoded Azure AD credentials and uses Outlook mailbox polling (Graph API/OData) to receive AES-encrypted commands and exfiltrate results, deleting command emails after processing; researchers link the Linux and Windows variants by shared keys, code structure, and identical developer mistakes, with initial samples uploaded from India and Afghanistan.