CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

GopherWhisper APT compromises Mongolian government systems with Go-based backdoors via Discord, Slack, and Office 365

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A previously undocumented China-aligned APT group named GopherWhisper has compromised at least 12 systems across Mongolian governmental institutions using a suite of Go-based backdoors and loaders. The threat actor abuses legitimate services—Discord, Slack, Microsoft 365 Outlook, and file.io—for command-and-control (C2) communications and data exfiltration. Initial access vectors remain undisclosed, but post-compromise activity includes lateral movement, data collection, and persistent remote access. Operational activity aligns with China Standard Time, with C2 traffic primarily occurring during standard working hours, suggesting human operator involvement.

Timeline

  1. 23.04.2026 12:04 1 articles · 2h ago

    GopherWhisper APT compromises 12 Mongolian government systems with Go-based backdoors via cloud services

    ESET identifies a China-aligned APT group, GopherWhisper, compromising at least 12 systems across Mongolian governmental institutions starting January 2025. The threat actor deploys a suite of Go-based backdoors (e.g., LaxGopher, RatGopher, CompactGopher) and a C++ backdoor (SSLORDoor) for persistent access, lateral movement, and data exfiltration. Abuse of legitimate services—Discord, Slack, Microsoft 365 Outlook, and file.io—facilitates C2 and exfiltration. BoxOfFriends uses Outlook’s Microsoft Graph API with hard-coded credentials for C2, while CompactGopher gathers and exfiltrates files encrypted with AES-CFB-128. Telemetry indicates dozens of additional potential victims, with C2 activity aligning with China Standard Time working hours.

    Show sources
    Open in new tab

Information Snippets