The Spy Group Using a Pizza Restaurant’s Name to Receive Secret Commands

Inside Harvester’s GoGra Linux Backdoor — How a Nation-State APT Turned Microsoft Outlook Into a Hidden Command Server

The malware checked an Outlook inbox named “Zomato Pizza” every two seconds. That inbox was a spy’s command terminal.

Imagine a spy leaving dead-drop messages inside a pizza restaurant’s order system.

Now imagine that restaurant is Microsoft Outlook.

And the spy is a nation-state hacking group with targets in India and Afghanistan.

That is exactly what researchers at Symantec and Carbon Black uncovered in April 2026.

A threat actor known as Harvester — believed to be state-sponsored and active since at least 2021 — deployed a brand new Linux backdoor that used the Microsoft Graph API and a hardcoded Outlook mailbox folder named “Zomato Pizza” as its entire command-and-control channel.

No suspicious domains. No exotic network traffic. No custom servers to track down.

Just Microsoft’s own cloud infrastructure — used against Microsoft’s own customers.

Why This Campaign Matters

Most malware researchers expect C2 infrastructure to look like C2 infrastructure.

Custom IPs. Registered domains. Encrypted tunnels to unusual endpoints.

Harvester’s GoGra backdoor had none of that.

Every command it received arrived as an email to an Outlook inbox. Every result it sent back left as an email reply. Every trace it left behind was immediately deleted.

That is what makes this campaign technically remarkable.

It did not abuse a vulnerability in Microsoft. It used Microsoft’s API exactly as designed.

And that is precisely why it is so hard to stop.

The most elegant attack is one where the weapon is indistinguishable from the furniture.

Who Is Harvester?

Harvester is a nation-state-backed APT group with a documented focus on South Asia.

Researchers first identified them in 2021, targeting organizations in Afghanistan, including government agencies, telecom providers, and IT firms.

Their toolset combines:

• Custom malware built in-house
• Publicly available offensive tools
• Cloud-native C2 infrastructure that abuses legitimate services

Their previous signature tool — Graphon — also used Microsoft infrastructure for command-and-control.

GoGra is the direct evolution of that approach.

Same philosophy. Expanded platform support. Now targeting Linux servers in addition to Windows machines.

The Lure: A Pizza App, a Pilgrimage, a Foreign Minister

Harvester’s initial access technique was social engineering — but executed with regional precision.

The attackers crafted decoy documents carefully tailored to their target demographic.

Examples of filenames used as lures:

TheExternalAffairesMinister. pdf
Details Format. pdf
umrah.pdf

Notice the deliberate space before .pdf in several filenames.

That was not a typo.

It was a trick.

The actual files were Linux ELF executables — binary files that run directly as programs. By appending . pdf (with a space) instead of .pdf, the attackers made the files appear to be documents in file manager previews, while the operating system still recognized them as executables and ran them.

The content of the decoy documents was equally targeted:

• “TheExternalAffairesMinister.pdf” — mimicking Indian foreign policy material
• “umrah.pdf” — referencing the Islamic pilgrimage to Mecca, aimed at South Asian Muslim communities
• A Zomato Pizza-themed document — Zomato being India’s most popular food delivery platform, with a real restaurant called Dragan Dash Kitchen located in Hyderabad

These were not generic phishing lures.

They were crafted for a specific country, a specific culture, and specific targets within it.

The Infection Chain: From Fake PDF to Hidden Service

When a victim opened one of the malicious files, a Go-language dropper executed.

It did three things:

1. Unpacked and wrote a roughly 5.9 MB i386 executable to disk at:

~/.config/systemd/user/userservice

1. Registered a systemd user unit so the malware automatically restarted on every reboot
2. Created an XDG autostart entry that disguised itself as “Conky” — a legitimate and widely used Linux system monitor

The result was a persistent implant that survived reboots, looked like a legitimate system process, and never drew attention to itself in process lists.

The Backdoor: Microsoft Graph API as a Command Server

This is where GoGra’s true sophistication becomes clear.

The inner i386 implant contained hardcoded Azure AD application credentials — baked directly into the binary in plaintext:

• Tenant ID
• Client ID
• Client Secret

Using these credentials, the malware authenticated to Microsoft’s cloud and obtained a valid OAuth2 access token.

With that token, it could operate inside a legitimate Microsoft 365 environment as if it were an authorized application.

The command loop worked like this:

Step 1 — Receive a command:

The implant polled an Outlook mailbox folder named “Zomato Pizza” every two seconds, looking for new emails with subject lines beginning with the word Input.

Step 2 — Decrypt and execute:

When a matching email arrived, the malware:

• Decoded the email body from Base64
• Decrypted it using AES-CBC encryption
• Executed the decrypted payload via /bin/bash -c

Step 3 — Send results back:

After execution, the implant:

• AES-encrypted the output
• Sent it back as an email reply with the subject line Output

Step 4 — Clean up:

The original tasking email was immediately deleted via an HTTP DELETE command to the Microsoft Graph API.

No command history. No evidence of tasking. Just a clean inbox.

The attacker’s side looked like someone managing an Outlook folder. The victim’s side looked like normal Microsoft 365 API traffic.

The Zomato Pizza Folder — And What It Tells Us

The choice of mailbox folder names is not accidental.

• Linux version: folder named "Zomato Pizza"
• Windows version: folder named "Dragan Dash"

Dragan Dash Kitchen is a real food delivery restaurant in Hyderabad, India. Zomato is the app Indians use to order from places exactly like Dragan Dash.

This tells researchers something important about attribution and targeting.

The folder names are thematic anchors — chosen to blend into the operational context of the campaign.

An analyst glancing at Microsoft Graph API logs from an Indian organization would see traffic to Outlook. They would not think twice about a folder named after a local food delivery brand.

That is the point.

Linux vs. Windows: The Same Spy, Two Operating Systems

Researchers confirmed that the Linux GoGra variant and the previously documented Windows version share a nearly identical codebase.

The C2 logic is unchanged across both platforms. Even the bugs are the same.

Symantec identified matching hardcoded spelling errors across both builds:

json:"@odata.ontext"          ← should be @odata.context
error occured in decryption   ← should be occurred
Commad Executed               ← should be Command
ExcuteCommand()               ← should be ExecuteCommand
DeleteingMessage()            ← should be DeletingMessage

These are not the kinds of mistakes that appear by coincidence across independent codebases.

They are the fingerprints of a single developer — or team — maintaining one shared codebase compiled for multiple platforms.

Same key. Same typos. Same logic. Different OS.

Harvester is not a Windows-only threat anymore.

Why Hiding Inside Microsoft’s Own API Works

The Microsoft Graph API is used by millions of legitimate applications every day.

It powers calendar sync tools, HR platforms, CRM integrations, and productivity apps across every major enterprise on earth.

Traffic to graph.microsoft.com is:

• Encrypted with TLS
• Expected on every corporate network
• Impossible to block without disabling core Microsoft 365 functionality
• Indistinguishable from any other authorized app in standard logs

That is exactly why Harvester — and a growing number of other APT groups have migrated their C2 infrastructure to Microsoft’s cloud.

Researchers at Symantec have tracked a sharp increase in threats abusing the Graph API since 2024, from groups including:

• Bluelight (APT37 — North Korea)
• SiestaGraph (China-linked)
• Graphon (Harvester’s own earlier tool)
• GoGra (this campaign)

The pattern is clear.

Nation-state actors have discovered that the best place to hide is inside the infrastructure their targets already trust.

What Defenders Are Missing

Traditional perimeter defenses are almost useless against this technique.

Signature-based antivirus? The dropper is a clean Go binary. The payload looks like a system service.

Firewall rules? All traffic goes to graph.microsoft.com over HTTPS 443.

Domain blocklists? You cannot block Microsoft’s own API without breaking your organization.

Email filtering? The malicious emails are sent to a mailbox the attacker controls, not to victims.

What actually catches this:

• Behavioral detection — unusual processes making Graph API calls
• OAuth2 audit logs — reviewing which Azure AD app registrations exist and what permissions they have claimed
• Anomalous systemd unit monitoring — new user-level services registered without IT involvement
• Memory forensics — examining what is running inside processes, not just which processes exist

The threat is not at the perimeter.

It is inside the platform.

Indicators of Compromise (IOCs)

Malware File Hashes

GoGra Linux Backdoor
SHA-256: 9c23c65a8a392a3fd885496a5ff2004252f1ad4388814b20e5459695280b0b82

GoGra Linux Backdoor (variant)
SHA-256: 2d0177a00bed31f72b48965bee34cec04cb5be8eeea66ae0bb144f77e4d439b1

GoGra Linux Backdoor (variant)
SHA-256: 74ac41406ce7a7aa992f68b4b3042f980027526f33ec6c8d84cb26f20495c9dc

TheExternalAffairesMinister.zip (dropper archive)
SHA-256: 57cd5721bae65c29e58121b5a9b00487a83b6c37dded56052cab2a67f90ea943

ZIP file containing GoGra Linux Backdoor
SHA-256: d8d84eaba9b902045ae4fe044e9761ad0ce9051b85feea3f1cf9c80b59b2b123

Host-Based Indicators

Malware persistence path:
~/.config/systemd/user/userservice

Autostart masquerade:
XDG autostart entry named "Conky"

AES encryption key (hardcoded):
b14ca5898a4e4133bbce2ea2315a1916

Outlook mailbox folder (Linux):
"Zomato Pizza"

Outlook mailbox folder (Windows):
"Dragan Dash"

Email subject — incoming commands:
Subject starts with: "Input"

Email subject — outgoing results:
Subject: "Output"

Behavioral Indicators

Process: userservice (i386 ELF running as systemd user unit)
API calls: OAuth2 token requests to login.microsoftonline.com
API calls: OData polling to graph.microsoft.com/v1.0/me/mailFolders
Command execution: /bin/bash -c [decrypted payload]
Cleanup: HTTP DELETE to graph.microsoft.com (message deletion)

Final Thoughts

Harvester’s GoGra campaign is a glimpse at where cyber espionage is heading.

The battlefield is no longer a network perimeter.

It is the cloud itself.

When attackers can hide inside Microsoft’s own infrastructure — authenticated, encrypted, expected — traditional detection has almost nothing to grab onto.

The choice of “Zomato Pizza” as the command mailbox folder is almost darkly comic.

A nation-state spy operation, issuing classified commands through an inbox named after a Hyderabad food delivery restaurant.

But that absurdity is the point.

The most effective camouflage does not look like camouflage. It looks like lunch.

The expansion to Linux is equally significant.

Enterprise servers, cloud workloads, CI/CD pipelines, development environments — they are all Linux. And they are all now within Harvester’s operational scope.

Patch your systems. Audit your Azure AD app registrations. Monitor your systemd user units.

Because the next dead-drop might already be sitting in someone’s inbox.

Waiting for the word Input.

References & Further Reading

Primary Research

• Symantec / Carbon Black Threat Hunter Team — Harvester: New GoGra Linux Backdoor
• Symantec — Harvester: Nation-State Group Targets South Asia (2021)
• Symantec — Graph API: Growing Number of Threats Abusing Microsoft API
• Symantec — Cloud Cover: Malicious Actors Leveraging Cloud Services

Threat Intelligence Frameworks

• MITRE ATT&CK — Web Service C2 (T1102)
• MITRE ATT&CK — Masquerading (T1036)
• MITRE ATT&CK — Boot or Logon Initialization Scripts (T1037)
• MITRE ATT&CK — Email Collection (T1114)

Malware Analysis Tools

• VirusTotal
• ANY.RUN Interactive Malware Sandbox
• MalwareBazaar by abuse.ch

Microsoft Infrastructure References

• Microsoft Graph API Documentation
• Microsoft Azure AD OAuth2 Security Best Practices

Tags: #Cybersecurity #Malware #MalwareAnalysis #Hacking #ThreatIntelligence #Linux #Technology #InfoSec

If this breakdown was useful:

Share it with someone studying threat intelligence or Linux security. Drop a question in the comments — I answer all of them. Or follow for more breakdowns of active APT campaigns.