Loading story…
The likely nation-state-backed Harvester group has expanded its espionage operations in South Asia with a new Linux variant of its GoGra backdoor, extending a toolset previously associated with Windows intrusions. Researchers linked the malware to Harvester through near-identical code, shared command-and-control logic, and matching spelling errors, and said the backdoor uses the Microsoft Graph API and Outlook mailboxes as a covert C2 channel to blend malicious traffic with legitimate cloud activity. Initial submissions tied to the malware came from India and Afghanistan, and the use of localized decoy documents indicates a tailored campaign against regional targets.
Harvester has been active since at least 2021 and was previously observed targeting telecommunications, government, and IT organizations, particularly in Afghanistan, with custom malware including Backdoor.Graphon, a downloader, and a screenshot utility, alongside Cobalt Strike Beacon and Metasploit. In both earlier and newer activity, the group abused legitimate Microsoft infrastructure to evade perimeter defenses; the Linux GoGra sample persists through a systemd user service and an XDG autostart entry, then executes commands delivered through encrypted email messages. The campaign shows Harvester building a cross-platform espionage capability while maintaining a consistent focus on South Asian victims.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers said initial VirusTotal submissions for the Linux GoGra malware came from India and Afghanistan, indicating likely targeting in those countries. They also noted localized decoy documents consistent with a tailored espionage campaign aimed at South Asia.
Symantec and the Carbon Black Threat Hunter Team reported that Harvester expanded its toolset with a Linux version of the GoGra backdoor. The malware uses Microsoft Graph API and Outlook mailboxes as a covert command-and-control channel and was linked to Harvester through strong code similarities with earlier Windows samples.
During the 2021 campaign, Harvester deployed custom malware including the Graphon backdoor, a downloader, and a screenshot utility, alongside Cobalt Strike Beacon and Metasploit. The group used Microsoft Azure Websites and CloudFront infrastructure for command-and-control to blend malicious traffic with legitimate services.
Symantec published research describing Harvester as a previously unseen, likely nation-state-backed espionage actor. The report said the campaign had been observed from June through October 2021 and highlighted its focus on South Asian targets.
Harvester activity began in June 2021, targeting organizations in South Asia, particularly in Afghanistan. Victims were identified in the telecommunications, government, and IT sectors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
broadcom.com
Open sourcesecurity.com
Open sourcesecurity.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Harvester APT group has deployed a new Linux variant of its **GoGra** backdoor, extending a previously documented Windows espionage toolset into a cross-platform capability aimed at targets in South Asia. Researchers from Symantec and the Carbon Black Threat Hunter Team said evidence from VirusTotal submissions and lure themes points to likely targeting in **India** and **Afghanistan**, with decoy documents referencing regional subjects such as **Zomato** and **Umrah**. The campaign delivers ELF payloads disguised as PDF files, using a dropper to display a lure document while covertly launching the backdoor. Once installed, the Linux malware uses **Microsoft Graph API** and Outlook mailboxes as a covert command-and-control channel, blending malicious traffic with legitimate cloud activity to evade perimeter monitoring. The backdoor relies on hardcoded Azure AD credentials, polls a designated Outlook folder for encrypted email tasking, executes commands through `/bin/bash`, exfiltrates results by email, and deletes messages to reduce forensic visibility. Researchers linked the Linux and Windows variants through nearly identical code, shared C2 logic, and even matching spelling mistakes in strings and function names, indicating both were likely developed by the same threat actor.
Jun 29, 2026
Security researchers reported **Pakistan-linked threat activity** targeting Indian government entities in campaigns dubbed **Gopher Strike** and **Sheet Attack**, assessed with *medium confidence* to potentially originate from a new subgroup or a parallel Pakistan-based actor rather than being definitively attributable to **APT36**. **Sheet Attack** uses legitimate services including **Google Sheets**, **Firebase**, and email for command-and-control (C2), while **Gopher Strike** begins with phishing emails delivering deceptive PDFs that display blurred content and a fake prompt to install an *Adobe Acrobat Reader DC* update. In **Gopher Strike**, clicking the “Download and Install” lure triggers delivery of an **ISO** payload only when server-side checks confirm the victim is in India and using a Windows user agent, a tactic intended to evade automated analysis. The ISO contains a Golang downloader, **GOGITTER**, which creates a VBScript (e.g., `windows_api.vbs`) in common directories (including `C:\Users\Public\Downloads`, `C:\Users\Public\Pictures`, and `%APPDATA%`) to poll for instructions and retrieve additional payloads, including **GITSHELLPAD**, which is described as leveraging **private GitHub repositories** (with embedded authentication tokens) for staging/persistence and follow-on access.
Jun 29, 2026
A long-running espionage campaign targeted government and diplomatic entities in Southeast Asia using **GoSerpent**, a Go-based backdoor that researchers say has been active since late 2025, with earlier variants seen against regional victims as far back as 2021. The malware established persistence as a Windows service and used stealth features including encrypted arguments, obfuscated strings, and payload execution inside `svchost`, while command-and-control infrastructure was hosted through legitimate providers to blend in with normal traffic. The operators used GoSerpent to deploy follow-on tooling for file collection, credential dumping, proxying, and data theft, and later returned with an expanded toolkit that included **Stowaway** and the **TmcLoader/TmcPayload** exfiltration chain. Researchers said the activity showed deliberate coordination across intrusion stages, from initial backdoor access through credential theft and staged exfiltration, and noted a possible but unconfirmed connection to the **TetrisPhantom** threat actor.
Jul 24, 2026