GopherWhisper

GopherWhisper is a previously undocumented China-aligned APT group identified by ESET. It has been active since at least November 2023 and was discovered in January 2025 after ESET found the LaxGopher backdoor on systems belonging to a Mongolian governmental institution. ESET telemetry indicated compromise of about 12 systems at that institution, and analysis of Slack and Discord command-and-control traffic suggested dozens of additional victims, although their sectors and locations were not identified. The group targets governmental institutions in Mongolia and is described as state-backed or consistent with cyber espionage activity. GopherWhisper uses a custom malware arsenal composed largely of Go-based tools, plus one C++ backdoor. Identified components include the backdoors LaxGopher, RatGopher, BoxOfFriends, and SSLORDoor; the injector JabGopher; the loader/injector FriendDelivery; and the exfiltration utility CompactGopher. JabGopher side-loads and injects LaxGopher into svchost.exe using process hollowing. LaxGopher uses Slack for command and control and supports command execution via cmd.exe, file upload, download of additional malware, and configuration changes. RatGopher is a Go-based backdoor that uses Discord for command and control and supports command execution and file transfer, including use of file.io. BoxOfFriends is a Go-based backdoor that uses Microsoft Graph API and Outlook draft email messages for bidirectional command and control. SSLORDoor is a C++ backdoor that communicates over raw TCP port 443 using OpenSSL BIO and supports host enumeration, hidden cmd.exe execution, file operations, drive enumeration, and proxy socket creation. CompactGopher compresses, encrypts, and exfiltrates files to file.io. FriendDelivery loads and injects BoxOfFriends and establishes persistence via a Windows service. A defining characteristic of GopherWhisper is its abuse of legitimate services for command and control and exfiltration, specifically Slack, Discord, Microsoft 365 Outlook via Microsoft Graph, and file.io. ESET recovered thousands of messages from attacker-controlled Slack and Discord infrastructure and also analyzed Outlook draft-message communications, exposing testing activity, development artifacts, and post-compromise operations. ESET assessed the group as China-aligned based on Slack metadata containing zh-CN locale information and operator activity patterns aligning with UTC+8 working hours. ESET stated it found no code similarities or TTP overlap linking GopherWhisper to previously known threat actors. Known aliases and sub-groups directly mentioned in the content are limited to the actor name GopherWhisper itself.