securityaffairsApr 26
#GopherWhisper: new #China-linked #APT targets Mongolia with Go-based #malware
https://securityaffairs.com/191318/apt/gopherwhisper-new-china-linked-apt-targets-mongolia-with-go-based-malware.html
#securityaffairs #hacking
GopherWhisper: new China-linked APT targets Mongolia with Go-based malware

ESET found a new China-linked APT, GopherWhisper, targeting Mongolia using Go-based malware, loaders, and backdoors.

Security Affairs
The Threat CodexApr 25
GopherWhisper: A burrow full of malware
#GopherWhisper #LaxGopher #RatGopher #JabGopher #CompactGopher #SSLORDoor
https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/
GopherWhisper: A burrow full of malware

ESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions.

(in)sicurezza digitaleApr 24

GopherWhisper: il nuovo APT cinese che spia il governo mongolo nascondendo il C2 in Slack, Discord e Outlook

ESET Research ha scoperto GopherWhisper, un APT cinese attivo dal 2023 che ha compromesso 12 sistemi governativi mongoli usando Discord, Slack e le bozze di Microsoft Outlook come canali C2. Il gruppo dispone di sette tool personalizzati tra cui quattro backdoor distinte scritte in Go e C++.

https://insicurezzadigitale.com/gopherwhisper-il-nuovo-apt-cinese-che-spia-il-governo-mongolo-nascondendo-il-c2-in-slack-discord-e-outlook/

CyberNetsecIOApr 24

📰 New 'GopherWhisper' APT Group Linked to China Targets Mongolian Government

New China-aligned APT 'GopherWhisper' discovered targeting Mongolian gov't. 🕵️‍♂️ The group uses a Go-lang toolkit and evades detection by using Slack, Discord, and Outlook for C2 communications. #APT #CyberEspionage #GopherWhisper #ThreatIntel

🔗 https://cyber.netsecops.io/articles/new-gopherwhisper-apt-group-targets-mongolian-government/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

New 'GopherWhisper' APT Group Linked to China Targets Mongolian Government

ESET discovers GopherWhisper, a new China-aligned APT group targeting the Mongolian government with a Go-based malware toolkit that uses Slack, Discord, and Outlook for C2.

CyberNetSec.io
The New OilApr 24

New #GopherWhisper #APT group abuses #Outlook, #Slack, #Discord for comms

https://www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/

#cybersecurity

New GopherWhisper APT group abuses Outlook, Slack, Discord for comms

A previously undocumented state-backed threat actor named GopherWhisper is using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord in attacks against government entities.

BleepingComputer
Analyst207Apr 23

China-Linked APT Group Exploits Legitimate Services for Covert Ops

ESET researchers have uncovered a treasure trove of clues, analyzing 6,044 Slack messages and 3,005 Discord messages that reveal the covert operations of a China-linked APT group, dubbed GopherWhisper, which has been active since at least 2023. The recovered logs provide a rare glimpse into the group's tactics, thanks to hardcoded credentials…

https://osintsights.com/china-linked-apt-group-exploits-legitimate-services-for-covert-ops?utm_source=mastodon&utm_medium=social

#ChinalinkedApt #Gopherwhisper #AptGroup #CovertOps #Slack

China-Linked APT Group Exploits Legitimate Services for Covert Ops

Uncover the tactics of China-linked APT group GopherWhisper, exploiting legitimate services for covert ops - learn how to protect your organization now with expert insights and security measures.

OSINTSights
Analyst207Apr 23

China-Linked GopherWhisper Targets Mongolian Government Systems with Go Backdoors

A China-linked cyber group, dubbed GopherWhisper, has been targeting Mongolian government systems with a suite of Go-based backdoors, infecting at least 12 systems and potentially dozens more. The attackers used clever tactics, routing command-and-control traffic through compromised Discord and Slack servers.

https://osintsights.com/china-linked-gopherwhisper-targets-mongolian-government-systems-with-go-backdoor?utm_source=mastodon&utm_medium=social

#Chinalinked #Gopherwhisper #GoBackdoors #MongolianGovernment #Eset

China-Linked GopherWhisper Targets Mongolian Government Systems with Go Backdoors

Discover how China-linked GopherWhisper targets government systems with Go backdoors, learn more about the threat and take action to protect your organization now.

OSINTSights
ESET ResearchApr 23
#ESETresearch discovered #GopherWhisper, a new China-aligned APT group that targeted a governmental entity in Mongolia. https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/
The group wields a wide array of tools mostly written in Go, using injectors and loaders to deploy and execute various backdoors in its arsenal.
Of the seven tools we discovered, four are backdoors – LaxGopher, RatGopher, and BoxOfFriends are written in Go, and SSLORDoor in C++. The rest comprise the injector JabGopher, the Go-based exfiltration tool CompactGopher, and the loader FriendDelivery.
GopherWhisper abuses legitimate services, notably #Discord, #Outlook, #Slack, and file.io for C&C communication and exfiltration. We managed to extract thousands of Slack and Discord C&C messages, gaining insight into the inner workings of the group.
Timestamp inspection of the messages showed that the bulk were sent during working hours in the UTC+8 time zone, which aligns with China. We also discovered that the group’s Slack and Discord servers were being used as C&Cs for LaxGopher and RatGopher.
We presented these findings on April 15th, at the #Botconf2026 conference in a talk titled Meet GopherWhisper: Uncovering an APT’s secrets through its own words.
Our detailed analysis of GopherWhisper’s toolset and C&C traffic is also available in our latest white paper: https://web-assets.esetstatic.com/wls/en/papers/white-papers/gopherwhisper-burrow-full-malware.pdf IoCs can be found there, as well as in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/gopherwhisper