Loading story…
The Harvester APT group has deployed a new Linux variant of its GoGra backdoor, extending a previously documented Windows espionage toolset into a cross-platform capability aimed at targets in South Asia. Researchers from Symantec and the Carbon Black Threat Hunter Team said evidence from VirusTotal submissions and lure themes points to likely targeting in India and Afghanistan, with decoy documents referencing regional subjects such as Zomato and Umrah. The campaign delivers ELF payloads disguised as PDF files, using a dropper to display a lure document while covertly launching the backdoor.
Once installed, the Linux malware uses Microsoft Graph API and Outlook mailboxes as a covert command-and-control channel, blending malicious traffic with legitimate cloud activity to evade perimeter monitoring. The backdoor relies on hardcoded Azure AD credentials, polls a designated Outlook folder for encrypted email tasking, executes commands through /bin/bash, exfiltrates results by email, and deletes messages to reduce forensic visibility. Researchers linked the Linux and Windows variants through nearly identical code, shared C2 logic, and even matching spelling mistakes in strings and function names, indicating both were likely developed by the same threat actor.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The newly documented Linux GoGra variant was found using Microsoft Graph API and Outlook mailboxes as a covert command-and-control channel. It polls mailbox folders for encrypted tasking, executes commands through /bin/bash, returns results by email, and deletes messages to reduce detection.
Researchers assessed that Harvester used the Linux GoGra backdoor in espionage activity likely targeting entities in South Asia, with VirusTotal submissions originating from India and Afghanistan and lure themes tied to the region. The malware was delivered via social-engineering lures disguised as PDF documents, with a dropper showing a decoy document while launching the backdoor.
Symantec and the Carbon Black Threat Hunter Team reported that the Harvester APT group expanded its previously known Windows GoGra malware into a Linux ELF variant. The Linux and Windows samples share nearly identical code, command-and-control logic, and matching spelling mistakes, indicating common authorship.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The likely nation-state-backed **Harvester** group has expanded its espionage operations in South Asia with a new Linux variant of its `GoGra` backdoor, extending a toolset previously associated with Windows intrusions. Researchers linked the malware to Harvester through near-identical code, shared command-and-control logic, and matching spelling errors, and said the backdoor uses the **Microsoft Graph API** and Outlook mailboxes as a covert C2 channel to blend malicious traffic with legitimate cloud activity. Initial submissions tied to the malware came from **India** and **Afghanistan**, and the use of localized decoy documents indicates a tailored campaign against regional targets. Harvester has been active since at least 2021 and was previously observed targeting **telecommunications, government, and IT organizations**, particularly in Afghanistan, with custom malware including **Backdoor.Graphon**, a downloader, and a screenshot utility, alongside **Cobalt Strike Beacon** and **Metasploit**. In both earlier and newer activity, the group abused legitimate Microsoft infrastructure to evade perimeter defenses; the Linux `GoGra` sample persists through a `systemd` user service and an XDG autostart entry, then executes commands delivered through encrypted email messages. The campaign shows Harvester building a cross-platform espionage capability while maintaining a consistent focus on South Asian victims.
Jun 29, 2026
Security researchers reported **Pakistan-linked threat activity** targeting Indian government entities in campaigns dubbed **Gopher Strike** and **Sheet Attack**, assessed with *medium confidence* to potentially originate from a new subgroup or a parallel Pakistan-based actor rather than being definitively attributable to **APT36**. **Sheet Attack** uses legitimate services including **Google Sheets**, **Firebase**, and email for command-and-control (C2), while **Gopher Strike** begins with phishing emails delivering deceptive PDFs that display blurred content and a fake prompt to install an *Adobe Acrobat Reader DC* update. In **Gopher Strike**, clicking the “Download and Install” lure triggers delivery of an **ISO** payload only when server-side checks confirm the victim is in India and using a Windows user agent, a tactic intended to evade automated analysis. The ISO contains a Golang downloader, **GOGITTER**, which creates a VBScript (e.g., `windows_api.vbs`) in common directories (including `C:\Users\Public\Downloads`, `C:\Users\Public\Pictures`, and `%APPDATA%`) to poll for instructions and retrieve additional payloads, including **GITSHELLPAD**, which is described as leveraging **private GitHub repositories** (with embedded authentication tokens) for staging/persistence and follow-on access.
Jun 29, 2026
ESET disclosed a previously undocumented, China-aligned APT group dubbed **GopherWhisper** after uncovering an intrusion affecting about 12 systems at a Mongolian governmental institution, with command-and-control traffic indicating there may be dozens of additional victims. The campaign relied on a largely Go-based malware arsenal—including the **LaxGopher** backdoor, loaders, injectors, file collection and exfiltration tools, and a C++ backdoor called **SSLORDoor**—to maintain access and move data after compromise. The initial access vector remains unknown, but investigators first identified the activity in January 2025 on a Mongolian government system. The group concealed malicious communications inside trusted enterprise traffic by abusing **Slack**, **Discord**, **Microsoft 365 Outlook** draft messages via the Microsoft Graph API, direct encrypted traffic over port 443, and **file.io** for exfiltration and C2 support. ESET said recovered Slack and Discord API tokens, along with thousands of operator messages and Outlook drafts, exposed the attackers’ development workflow, testing environments, and operational mistakes. Metadata such as UTC+8 working hours and locale settings supported the assessment that the actor is China-aligned, while Outlook artifacts showed infrastructure timing including creation of the mailbox `barrantaya.1010@outlook[.]com` and compilation of the **FriendDelivery** DLL in July 2024.
Jun 29, 2026