Security AffairsPierluigi Paganini
Trigona ransomware tool, Lotus Wiper and GoGra backdoor featured
Part of the GoGra story · since 22 Apr
- Wed 22 Apr, 16:20 UTC. The Hacker News, first report. Harvester Deploys Linux GoGra Backdoor Using Outlook for C2.
- Thu 23 Apr, 08:30 UTC. Security Affairs, its first report on the story. Harvester Group Uses GoGra Backdoor via Outlook Graph API.
- Sun 26 Apr, 12:21 UTC. Security Affairs. Trigona ransomware tool, Lotus Wiper and GoGra backdoor featured. This article, 3rd of 3.
The Security Affairs Malware Newsletter Round 94, written by Pierluigi Paganini and published on 26 April 2026, collects the best articles and research on malware from the international landscape. It presents a curated set of linked stories, including Trigona ransomware adopts custom tool to steal data and evade detection, Lotus Wiper: a new threat targeting the energy and utilities sector, and Harvester: APT Group Expands Toolset With New GoGra Linux Backdoor.
The roundup also highlights FIRESTARTER Backdoor, with the accompanying reference to an analysis from ar26-113a, and Namastex[.]ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware among other entries. The piece is part of Security Affairs and is designed to offer readers a digest of malware-focused developments, alongside navigation and quick links to related topics such as Cyber Crime, Data Breach, and Hacking. According to CISA, the compilation serves as a reminder of ongoing threats and research across multiple malware families.
How the story developed
3 articles from 2 outlets since 22 Apr. Quiet since 26 Apr. This was the 3rd report, 4 days after the first.
- Wed 22 Apr, 16:20 UTC. The Hacker News, first report. Harvester Deploys Linux GoGra Backdoor Using Outlook for C2.
- Thu 23 Apr, 08:30 UTC. Security Affairs, its first report on the story. Harvester Group Uses GoGra Backdoor via Outlook Graph API.
- Sun 26 Apr, 12:21 UTC. Security Affairs. Trigona ransomware tool, Lotus Wiper and GoGra backdoor featured. This article, 3rd of 3.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 3 articles as a listHide the list
- Wed 22 AprDay 01
- Harvester Deploys Linux GoGra Backdoor Using Outlook for C216:20 · The Hacker News · First report
- Thu 23 AprDay 11
- Harvester Group Uses GoGra Backdoor via Outlook Graph API08:30 · Security Affairs
Quiet for 3 days
Sun 26 AprDay 41- Trigona ransomware tool, Lotus Wiper and GoGra backdoor featured12:21 · Security Affairs · Picked up again · This article, 3rd of 3