New GoGra malware for Linux uses Microsoft Graph API for comms

Symantec researchers detail a Linux GoGra backdoor used by the Harvester APT that authenticates to Microsoft cloud using hardcoded Azure AD credentials to access an Outlook mailbox (folder named "Zomato Pizza") via Microsoft Graph API, polling for AES-CBC-encrypted, base64-encoded commands with subjects starting "Input" and returning AES-encrypted execution results in reply emails "Output"; the dropper establishes persistence via systemd and an XDG autostart entry, disguises ELF payloads as PDFs, and deletes processed command emails to reduce visibility, while code similarities with the Windows variant indicate a shared developer and expanding targeting of telecom, government, and IT organizations in South Asia.