A new Linux variant of the GoGra backdoor is drawing attention for its stealthy use of legitimate cloud services to communicate with attackers. Researchers from Symantec have uncovered how this malware leverages Microsoft’s trusted infrastructure, making it significantly harder to detect using traditional security tools.

The malware is attributed to the Harvester APT, an espionage-focused group active since at least 2021. Known for targeting telecommunications, government, and IT sectors across South Asia, the group continues to evolve its techniques with this latest development.

What makes this variant particularly concerning is its use of the Microsoft Graph API to interact with Outlook mailboxes. Instead of relying on suspicious or easily detectable command-and-control servers, the malware uses legitimate Microsoft services as a communication channel. By authenticating with hardcoded Azure Active Directory credentials, it gains access to mailbox data and retrieves commands in a highly covert manner.

The attack begins with social engineering, where victims are tricked into executing malicious ELF binaries disguised as harmless PDF files. Once activated, the malware establishes persistence on the system using standard Linux mechanisms, including systemd services and autostart entries, while masquerading as legitimate system processes.

After installation, the malware continuously monitors a specific Outlook mailbox folder for incoming instructions. It scans emails with predefined subject patterns, decrypts hidden commands, and executes them locally. The results are then encrypted and sent back to the attacker through reply emails, maintaining a low profile by blending into normal email traffic.

Ad Banner

To further evade detection, the malware deletes command emails after processing them, reducing the chances of forensic discovery. This level of operational stealth highlights how attackers are increasingly abusing trusted platforms to bypass traditional security monitoring.

Researchers also noted that the Linux variant shares nearly identical code with its Windows counterpart, including the same encryption keys and coding patterns. This strongly suggests a unified development effort by the same threat actors, reinforcing attribution to the Harvester group.

The emergence of this Linux variant signals a broader shift in attacker strategy. By expanding their toolset beyond Windows environments, threat actors are targeting a wider range of systems, including servers and cloud infrastructure that often run on Linux.

Overall, this campaign underscores a growing trend in modern cyber threats—leveraging legitimate services to hide malicious activity. As attackers continue to blend in with normal operations, organizations must enhance visibility across cloud platforms and adopt more advanced detection strategies to identify subtle signs of compromise.

Recommended Cyber Technology News:

To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com  



🔒 Login or Register to continue reading