Harvester is a state-sponsored cyber espionage group that first emerged in mid-2021, assessed with medium confidence to be operating out of South Asia. The group's primary motivation is cyber espionage, characterized by the persistent targeting of government, telecommunications, and IT sectors. Harvester distinguishes itself by its extensive use of custom backdoors, including Graphon, Graphite, Graphican, and the GoGra Linux backdoor, and its operational model involves repurposing legitimate cloud services such as Microsoft Graph API, Outlook mailboxes, Dropbox, OneDrive, and Google Drive for covert command-and-control (C2) to blend malicious traffic with normal network activity and evade detection.