Loading malware…
GoGra is a backdoor used by the Harvester APT/cyberespionage group. Reporting describes both Windows and Linux variants, with the newer Linux version expanding Harvester’s tooling beyond Windows and likely supporting espionage activity focused on South Asia, particularly India and Afghanistan. Symantec and the Carbon Black Threat Hunter Team linked the Linux malware to Harvester’s earlier Windows activity based on near-identical code, shared command-and-control logic, the same AES key in some reporting, and matching coding mistakes such as "ExcuteCommand" and "error occured." GoGra is also described as functionally similar to Harvester’s earlier Graphon backdoor.
A defining characteristic of GoGra is its use of legitimate Microsoft infrastructure for covert command and control. The malware uses the Microsoft Graph API and Outlook mailboxes to receive tasking and return results, blending malicious traffic with trusted cloud communications and helping it evade traditional perimeter defenses. In Linux reporting, the implant contains hardcoded Azure AD credentials, requests OAuth2 tokens from Microsoft, polls a designated Outlook folder such as "Zomato Pizza" every two seconds using OData queries, filters for emails whose subject begins with "Input," decrypts base64-wrapped AES-CBC-encrypted message bodies, executes commands via "/bin/bash -c," encrypts execution results, sends them back in emails with subject "Output," and then deletes the original tasking message with an HTTP DELETE request to reduce forensic traces. Separate reporting on an earlier Windows sample states it was written in Go, used Microsoft mail services via Graph API, authenticated with OAuth access tokens, read Outlook messages where the subject began with "Input," supported command execution including "cd," and returned encrypted output with subject "Output."
Observed delivery and persistence behavior for the Linux variant indicates social-engineering-based initial access. Attackers used ELF binaries disguised as PDF documents by inserting a space before the extension, with lure filenames including "Zomato Pizza. pdf," "umrah.pdf," "TheExternalAffairesMinister. pdf," and "Details Format. pdf." A Go-based dropper displayed a decoy PDF or OpenDocument file while deploying an approximately 5.9 MB i386 payload to "~/.config/systemd/user/userservice." Persistence was established through a systemd user unit and an XDG autostart entry masquerading as the legitimate Conky Linux system monitor.
High-confidence targeting context in the reporting ties GoGra to Harvester operations against organizations in South Asia, including telecommunications, government, IT, and an unnamed media organization, with VirusTotal submissions from India and Afghanistan cited as likely indicators of targeting. Detection names mentioned in the content include Trojan.Gogra and Linux.GoGra Trojan.Gen.NPE.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Associated Malware & Tools graphon ... Graphican GoGra remsec_strider BirdyClient Grager graphite
23 distinct techniques documented for this family, organized by ATT&CK tactic.
It decrypts the malicious content in the emails, executes commands locally, and sends encrypted results back via reply emails...
Upon receiving an email, it decrypts the base64-wrapped message body using AES-CBC encryption, and executes the payload on the host via /bin/bash -c .
The hackers cleverly name a file something like “Zomato Pizza.pdf,” placing a tiny space between the name and the extension... the computer sees it as a Linux ELF binary program and runs it. Once the file is opened, a Go dropper shows a fake PDF or document so the user doesn’t get suspicious.
The GoGra backdoor abuses Microsoft cloud services by using hardcoded Azure AD credentials to obtain OAuth2 tokens.
The malware writes its internal payload to ~/.config/systemd/user/userservice and ensures execution upon system reboot by setting up a systemd user unit
This way, every time the computer restarts, GoGra starts running again.
The malware writes its internal payload to ~/.config/systemd/user/userservice and ensures execution upon system reboot by setting up a systemd user unit and an XDG autostart entry. This autostart entry actively masquerades as the legitimate "Conky" Linux system monitor.
The GoGra backdoor abuses Microsoft cloud services by using hardcoded Azure AD credentials to obtain OAuth2 tokens.
The malware writes its internal payload to ~/.config/systemd/user/userservice and ensures execution upon system reboot by setting up a systemd user unit
This way, every time the computer restarts, GoGra starts running again.
The malware writes its internal payload to ~/.config/systemd/user/userservice and ensures execution upon system reboot by setting up a systemd user unit and an XDG autostart entry. This autostart entry actively masquerades as the legitimate "Conky" Linux system monitor.
The attackers actively masquerade malicious ELF files as standard document files by appending extensions like “. pdf”, with a subtle space between the filename and the extension to ensure that the file still executes as a Linux binary.
...sending encrypted results back via reply emails, deleting the original command email to evade detection.
Following exfiltration, the implant issues an HTTP DELETE command to wipe the original tasking message and remove evidence of its presence.
These credentials allow the malware to request OAuth2 tokens directly from Microsoft and begin communicating through a real Outlook mailbox folder named “Zomato Pizza,” polling for new instructions every two seconds... Results are encrypted with the same AES key and sent back to the attacker via an email reply with the subject “Output.”
The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel, allowing it to bypass traditional perimeter network defenses.
The GoGra backdoor abuses Microsoft cloud services by using hardcoded Azure AD credentials to obtain OAuth2 tokens. It polls a specific Outlook mailbox folder via Microsoft Graph API, looking for emails with commands.
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux backdoor used for espionage. It is delivered via social-engineering lures disguised as PDF files, establishes persistence by writing files under ~/.config/systemd/user/userservice while masquerading as Conky, and uses Microsoft Graph API and Outlook mailboxes as a covert command-and-control channel. It polls for AES-CBC-encrypted commands and exfiltrates results by email.
GoGra is a backdoor used by the Harvester espionage group. The Linux variant is distributed via ELF binaries disguised as PDF files, establishes persistence using systemd and an XDG autostart entry, queries a specific Outlook mailbox folder through the Microsoft Graph API for command emails, decrypts and executes commands locally, and sends encrypted results back via reply emails while deleting the original command email to evade detection.
A cross-platform espionage backdoor used by Harvester that abuses Microsoft Graph API and real Outlook mailboxes as a covert C2 channel. The Linux variant is deployed by a Go dropper, establishes persistence via systemd user units and XDG autostart disguised as Conky, polls an Outlook folder for commands, executes them via /bin/bash, encrypts results, and deletes command emails to reduce forensic traces.
A cross-platform backdoor used for cyberespionage that abuses Microsoft Graph API and Outlook mailboxes as a covert command-and-control channel. It uses hardcoded Azure AD credentials to obtain OAuth2 tokens, polls mailbox folders for command emails, decrypts and executes payloads via /bin/bash -c, encrypts results, sends them back through Outlook, and deletes messages to reduce traces.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.