Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API

Harvester, an APT linked to espionage in South Asia, has deployed a new Linux Go-based backdoor named GoGra that uses Microsoft Graph API and Outlook mailboxes (folder "Zomato Pizza") as a covert C2 channel; the implant executes Base64-encoded shell commands from emails and exfiltrates results back via email. The attack uses ELF droppers disguised as PDFs to display lures while running the backdoor, and artifacts seen on VirusTotal from India and Afghanistan suggest targeted activity and an expansion of Harvester's toolset beyond Windows.