Harvester APT Expands Spying Operations with New GoGra Linux Malware

Researchers report that the nation-state-backed APT “Harvester” has deployed a new Linux backdoor called GoGra to spy on systems in India and Afghanistan; the malware uses social-engineered ELF attachments that display fake PDFs, persists under ~/.config/systemd/user/userservice as a Conky impersonator, and performs covert C2 over Microsoft Graph/Outlook using stolen Azure AD credentials and encrypted commands (subjects “Input”/“Output”), with similarities to the Windows backdoor Graphon indicating the same developers.