ESET Details GopherWhisper APT’s Backdoors in Attacks on Mongolian Government
Summary
ESET attributes a toolset of backdoors and injectors to China-linked GopherWhisper, which infected about 12 systems at a Mongolian government institution and likely targeted dozens more. Its tools use legitimate services for command and control and data exfiltration.
Key points
- ESET identified GopherWhisper while investigating a Go-based backdoor found at a Mongolian government institution; it says the group has been active since at least November 2023.
- ESET reports that LaxGopher uses Slack for command and control, executes commands, collects files, and can fetch and run additional payloads.
- CompactGopher compresses files and sends them to file[.]io; RatGopher uses Discord for command and control and can upload or download files through the service.
- BoxOfFriends communicates through draft Outlook messages using the Microsoft Graph API and can exfiltrate files, manipulate ports, and execute commands.
- ESET says the group infected roughly 12 systems at the Mongolian institution and likely targeted dozens of other victims.
- ESET created the GopherWhisper designation because it found no similarities in code, tactics, techniques, procedures, or targeting to an existing APT group.
Article Details
- Attack Vectors
- GopherWhisper used backdoors and custom injectors against a Mongolian government institution.
- LaxGopher used Slack for command-and-control, executed commands through command prompt, and could fetch and execute additional payloads.
- RatGopher used Discord for command-and-control and uploaded or downloaded files through file.io.
- CompactGopher compressed files and sent them to file.io using its public REST API.
- SSLORDoor communicated over raw TCP sockets and could spawn a hidden command prompt.
- BoxOfFriends communicated through draft Outlook messages using the Microsoft Graph API and could exfiltrate files and execute commands.
- JabGopher and FriendDelivery were used to run backdoors in memory or load a backdoor DLL.
MITRE ATT&CK
T1005 · Data from Local SystemCompactGopher collected files from infected systems, and BoxOfFriends could exfiltrate files.T1055 · Process InjectionJabGopher executed a backdoor in memory of a newly spawned svchost.exe process.T1055.001 · Dynamic-link Library InjectionFriendDelivery is described as a DLL injector that loads BoxOfFriends.T1059.003 · Windows Command ShellLaxGopher and other backdoors could execute commands through command prompt; SSLORDoor could spawn a hidden command prompt.T1083 · File and Directory DiscoveryGopherWhisper used LaxGopher to enumerate drives and files; SSLORDoor could also enumerate drives.T1102.002 · Bidirectional CommunicationLaxGopher used Slack, RatGopher used Discord, and BoxOfFriends used draft Outlook messages via the Microsoft Graph API for command-and-control communication.T1105 · Ingress Tool TransferLaxGopher could fetch and execute additional payloads on infected machines.T1560 · Archive Collected DataCompactGopher compressed files collected from the command line.T1567 · Exfiltration Over Web ServiceCompactGopher sent compressed files to file.io, and RatGopher could upload files to the service.
Threat Actors
Malware
BoxOfFriendstools that GopherWhisper deployed against the same Mongolian government organization, namely the BoxOfFriends Go backdoor that relies on the Microsoft Graph API for communication via draft Outlook messages, andCompactGopherOne of the tools that LaxGopher can deploy is CompactGopher, a file collector written in Go that can compress files from the command line and send them to the file.io file-sharing service using a public REST API.FriendDeliverybackdoor that relies on the Microsoft Graph API for communication via draft Outlook messages, and the FriendDelivery DLL injector that loads it.JabGopherAn injector named JabGopher is used to execute the backdoor in the memory of a newly spawned instance of svchost.exe.LaxGopherDubbed LaxGopher, the backdoor uses Slack for C&C communication and can execute commands via command prompt, exfiltrate victim data, and fetch and execute additional payloads on the infected machines.RatGopherAnother tool in GopherWhisper’s arsenal is RatGopher, a Go-based backdoor.SSLORDoorThe APT also relies on a C++ backdoor called SSLORDoor, which uses OpenSSL BIO for communication via raw TCP sockets.
Products
DiscordUnlike LaxGopher, it uses Discord for C&C communication.file.ioOne of the tools that LaxGopher can deploy is CompactGopher, a file collector written in Go that can compress files from the command line and send them to the file.io file-sharing service using a public REST API.Microsoft Graphthe same Mongolian government organization, namely the BoxOfFriends Go backdoor that relies on the Microsoft Graph API for communication via draft Outlook messages, and the FriendDelivery DLL injector that loads it.Outlooknamely the BoxOfFriends Go backdoor that relies on the Microsoft Graph API for communication via draft Outlook messages, and the FriendDelivery DLL injector that loads it.SlackDubbed LaxGopher, the backdoor uses Slack for C&C communication and can execute commands via command prompt, exfiltrate victim data, and fetch and execute additional payloads on the infected machines.
Countries
ChinaTracked as GopherWhisper (PDF) and active since at least November 2023, the hacking group is operating out of China, as timestamp inspection of chat messages and emails has revealed.Mongolia2025, during the investigation into a Go-based backdoor found on the systems of a governmental entity in Mongolia, which led to the identification of several other backdoors, custom loaders, and injectors associated