ESET Details GopherWhisper Malware Targeting Mongolian Government Entity
Summary
ESET describes GopherWhisper’s Go-heavy toolset targeting a Mongolian government entity, including backdoors using Slack, Discord and Outlook for C2 and file[.]io for exfiltration. Recovered messages and draft emails revealed operator activity.
Key points
- ESET found LaxGopher on a Mongolian governmental entity’s system in January 2025 and attributed the tools to a previously undocumented group it named GopherWhisper.
- The toolset includes Go-based backdoors LaxGopher, RatGopher and BoxOfFriends; injector JabGopher; loader FriendDelivery; file-collection tool CompactGopher; and C++ backdoor SSLORDoor.
- JabGopher injects LaxGopher into a new svchost.exe process; LaxGopher retrieves commands from a private Slack server, runs them via cmd.exe and returns results.
- RatGopher uses Discord for command-and-control, while BoxOfFriends uses Microsoft Graph to create and modify Outlook draft messages for C2.
- CompactGopher compresses files and exfiltrates them through file[.]io; SSLORDoor communicates over raw sockets on port 443 and supports file operations.
- ESET recovered thousands of Slack and Discord messages and several Outlook drafts, which revealed testing and post-compromise activity. Message timing and Slack locale informed ESET’s assessment that the group is China-aligned.
Article Details
- Attack Vectors
- JabGopher creates a new svchost.exe instance and injects LaxGopher, disguised as whisper.dll, into its process memory.
- LaxGopher retrieves command-and-control messages from a private Slack channel, runs commands through cmd.exe, and returns results to the channel; it can also download additional malware.
- RatGopher retrieves command-and-control messages from a private Discord server and publishes command results to a configured channel.
- BoxOfFriends uses the Microsoft Graph mail REST API to create and modify Microsoft 365 Outlook draft messages for command-and-control.
- CompactGopher compresses files and exfiltrates them to file.io; SSLORDoor communicates over raw sockets on port 443 and can enumerate drives and perform file operations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
barrantaya[.]1010@outlook[.]com | Outlook account linked to BoxOfFriends command-and-control; the article reports it was created on July 11, 2024. |
MITRE ATT&CK
T1005 · Data from Local SystemSSLORDoor can enumerate drives and open, read, write, delete, and upload files on the compromised system.T1055 · Process InjectionJabGopher injects LaxGopher into the memory of a newly created svchost.exe process.T1059.003 · Windows Command ShellLaxGopher executes commands through cmd.exe and publishes the results to its configured Slack channel.T1071.001 · Web ProtocolsLaxGopher and RatGopher use Slack and Discord for command-and-control; CompactGopher uses file.io for exfiltration.T1071.003 · Mail ProtocolsBoxOfFriends uses the Microsoft Graph mail REST API to create and modify Outlook draft messages for command-and-control.T1083 · File and Directory DiscoveryLaxGopher command-and-control messages were used to request disk and file enumeration on compromised machines.T1105 · Ingress Tool TransferLaxGopher can download additional malware to a compromised machine.T1567 · Exfiltration Over Web ServiceCompactGopher compresses collected files and automatically exfiltrates them to the file.io file-sharing service.T1574.001 · DLLThe article identifies whisper.dll, which carries the LaxGopher backdoor, as a malicious side-loaded component.
Threat Actors
Malware
BoxOfFriendsgovernmental entity and deployed a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor.CompactGopherand deployed a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor.FriendDeliverya diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor.JabGopherentity and deployed a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor.LaxGopherthat targeted a Mongolian governmental entity and deployed a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor.RatGophertargeted a Mongolian governmental entity and deployed a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor.SSLORDoortoolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor.
Vendors
Products
DiscordThe group abused legitimate services (Discord, Slack, Microsoft 365 Outlook, file.io) for C2 and exfiltration, and ESET extracted thousands of Slack and Discord messages and draft Outlook emails to analyze the group’sMicrosoft 365 OutlookThe group abused legitimate services (Discord, Slack, Microsoft 365 Outlook, file.io) for C2 and exfiltration, and ESET extracted thousands of Slack and Discord messages and draft Outlook emails to analyze the group’sMicrosoft GraphThe group leverages legitimate platforms—Slack, Discord, Microsoft 365 Outlook (Microsoft Graph API), and file.io—for command-and-control and data exfiltration.SlackThe group abused legitimate services (Discord, Slack, Microsoft 365 Outlook, file.io) for C2 and exfiltration, and ESET extracted thousands of Slack and Discord messages and draft Outlook emails to analyze the group’s