Article Details
Scrape Timestamp (UTC): 2024-08-07 10:41:44.956
Source: https://thehackernews.com/2024/08/new-go-based-backdoor-gogra-targets.html
Original Article Text
Click to Toggle View
New Go-based Backdoor GoGra Targets South Asian Media Organization. An unnamed media organization in South Asia was targeted in November 20233 using a previously undocumented Go-based backdoor called GoGra. "GoGra is written in Go and uses the Microsoft Graph API to interact with a command-and-control (C&C) server hosted on Microsoft mail services," Symantec, part of Broadcom, said in a report shared with The Hacker News. It's currently not clear how it's delivered to target environments, GoGra is specifically configured to read messages from an Outlook username "FNU LNU" whose subject line starts with the word "Input." The message contents are then decrypted using the AES-256 algorithm in Cipher Block Chaining (CBC) mode using a key, following which it executes the commands via cmd.exe. The results of the operation are then encrypted and sent to the same user with the subject "Output." GoGra is said to be the work of a nation-state hacking group known as Harvester owing to its similarities to a custom .NET implant named Graphon that also utilizes the Graph API for C&C purposes. The development comes as threat actors are increasingly taking advantage of legitimate cloud services to stay low-key and avoid having to purchase dedicated infrastructure. Some of the other new malware families that have employed the technique are listed below - "Although leveraging cloud services for command and control is not a new technique, more and more attackers have started to use it recently," Symantec said, pointing to malware like BLUELIGHT, Graphite, Graphican, and BirdyClient. "The number of actors now deploying threats that leverage cloud services suggests that espionage actors are clearly studying threats created by other groups and mimicking what they perceive to be successful techniques."
Daily Brief Summary
An unnamed South Asian media organization was targeted in November 20233 with a new Go-based backdoor malware named GoGra.
Symantec reported that GoGra interfaces with its command-and-control server through the Microsoft Graph API using Microsoft email services.
The malware decrypts received commands which are embedded in email messages, executes them, and sends back the encrypted results.
GoGra uses sophisticated encryption (AES-256 in CBC mode) for securing communication with the control server.
The malware is believed to be developed by a nation-state associated hacking group, dubbed Harvester, known for using similar techniques and tools.
Analysis suggests an emerging trend among threat actors to utilize legitimate cloud services to camouflage their operations and enhance the efficacy of their attacks.
GoGra shares functional similarities with another malware named Graphon, hinting at a possible shared lineage or development influenced by successful past tools.