Harvester's GoGra Backdoor Exploits Microsoft Graph API for Linux Targets

The threat actor known as Harvester is deploying a new Linux variant of its GoGra backdoor, specifically targeting entities in South Asia. The malware’s ingenuity lies in its command-and-control (C2) infrastructure, which leverages legitimate Microsoft Graph API and Outlook mailboxes. This sophisticated approach allows GoGra to blend in with normal network traffic, effectively bypassing traditional security perimeters and detection methods.

The Hacker News reports that this technique provides a covert channel for the attackers, making it significantly harder for defenders to identify and disrupt their operations. The reliance on cloud services like Microsoft Graph API highlights a growing trend where threat actors exploit trusted platforms for malicious purposes, posing a substantial challenge to current security postures.