Loading malware…
Graphon, also known as Backdoor.Graphon, is a custom Windows backdoor written in .NET and used by the Harvester cyberespionage group. It uses the Microsoft Graph API to communicate with command-and-control infrastructure hosted on legitimate Microsoft services, helping malicious communications blend with normal cloud traffic. Its functionality includes remote command execution and AES-encrypted command-and-control communications. Graphon was associated with Harvester's information-stealing operations targeting telecommunications, government, and information technology organizations in South Asia, with activity dating to June 2021. It is functionally similar to GoGra, another Harvester backdoor written in Go, but differs in implementation and some command-handling features. The Linux variants associated with this toolset belong to GoGra rather than establishing Linux support for Graphon.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Its toolset included a custom backdoor called Backdoor.Graphon that used the Graph API to communicate with Microsoft infrastructure for C&C purposes.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel
"GoGra ... uses the Microsoft Graph API to interact with a command-and-control (C&C) server hosted on Microsoft mail services..."; "Grager ... used the Graph API to communicate with a C&C server hosted on Microsoft OneDrive"; "Onedrivetools ... authenticates to Microsoft Graph API and downloads the second stage payload from OneDrive... fetching the new commands to execute from a file called cmd"
The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel, allowing it to bypass traditional perimeter network defenses.
The GoGra backdoor abuses Microsoft cloud services by using hardcoded Azure AD credentials to obtain OAuth2 tokens. It polls a specific Outlook mailbox folder via Microsoft Graph API, looking for emails with commands.
The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel... One of its tools is a custom backdoor called Graphon, which has similarities with GoGra and also uses Microsoft infrastructure for its C2 activity.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.