China-linked APT deploys new Linux backdoor

A China-linked advanced persistent threat (APT) group known as Harvester has deployed a previously undocumented Linux backdoor called GoGra in targeted operations across South Asia. The malware leverages the legitimate Microsoft Graph API for command-and-control communication, enabling covert data exfiltration and remote access on compromised Linux systems. This use of legitimate cloud infrastructure complicates network-based detection and represents an evolution in APT tradecraft. The targeting pattern aligns with Harvester's established focus on governmental and diplomatic entities in the region.