ESET Finds GopherWhisper Backdoors in Mongolian Government Systems
Summary
ESET says China-aligned GopherWhisper has been active since November 2023, finding 12 backdoored systems at one Mongolian government institution and evidence of dozens more potential victims. Five backdoors use varied cloud services for C2 or file transfer.
Key points
- ESET researchers say GopherWhisper has been active since November 2023 and targets Mongolian government institutions.
- ESET found 12 backdoored systems at one Mongolian government institution; evidence suggests dozens more victims may have been affected.
- The group used five backdoors: LaxGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor.
- LaxGopher uses Slack for C2, RatGopher uses Discord, and BoxOfFriends communicates through Microsoft Outlook email drafts.
- CompactGopher handles file exfiltration through file[.]io; the article says SSLORDoor does not abuse a SaaS platform.
- ESET researchers characterized the operators as prolific but not particularly sophisticated, and suggested they may be relatively new to malware development.
Article Details
- Event Type
- Cyber-espionage campaign targeting Mongolian government institutions with multiple custom backdoors and cloud-service-based C2.
- Impact
- ESET found 12 backdoored systems at one Mongolian government institution. The article says evidence suggests dozens more Mongolian victims may have been affected. The backdoors use services including Slack, Discord, and Outlook drafts for communications; CompactGopher manages file exfiltration via file.io.
People
Eric HowardESET malware researcher who presented observations at Botconf 2026 suggesting the operators might be new to malware development.Mathieu TartareESET senior malware researcher who assessed GopherWhisper's use of multiple custom backdoors and described the group as not particularly sophisticated.
Threat Actors
Emissary PandaIdentified in the article as an alias of APT27, which it says ran a campaign against a Mongolian national data center.GopherWhisperDescribed as a China-aligned APT active since November 2023 and targeting Mongolian government institutions with multiple custom backdoors.ICE RELICIdentified as a Russian threat actor that Google researchers found exploiting Mongolian government websites in 2023 and 2024 for watering-hole attacks that infected passersby’s devices with surveillanceware. The article identifies Midnight Blizzard as an alias.Midnight BlizzardIdentified in the article as an alias of APT29, which Google researchers found exploiting Mongolian government websites for watering-hole attacks in 2023 and 2024.RedDeltaThe article cites a 2023–2024 campaign targeting the government sector in Mongolia.SHORE CASTLEThe article reports a campaign against a Mongolian national data center a few years before the 2023–2024 period; it identifies Emissary Panda as an alias.
Malware
BoxOfFriendsThe group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development.CompactGopherThe group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development.FriendDelivery22, came yet another backdoor, “RatGopher.” March 5 unearthed a fourth backdoor, “BoxOfFriends,” and its loader, “FriendDelivery.” And on March 24, there was “SSLORDoor.”JabGopher2, 2025, ESET researchers discovered two malware samples: a backdoor, “LaxGopher,” and its injector, “JabGopher.” One might reasonably expect, at that point, that they had a pretty good idea of how this threat actor wasLaxGopherThe group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development.RatGopherThe group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development.SSLORDoorThe group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development.
Vendors
Products
DiscordEach backdoor leverages different C2 channels, abusing services like Slack, Discord, Outlook drafts, and file.io for communications and exfiltration.Microsoft OutlookBoxofFriends manages the same kinds of communications via email drafts in Microsoft Outlook.SlackEach backdoor leverages different C2 channels, abusing services like Slack, Discord, Outlook drafts, and file.io for communications and exfiltration.
Countries
ChinaGopherWhisper is a China-aligned APT active since November 2023 targeting Mongolian government networks.Mongolia#GopherWhisper #MongoliaRussiaI would say it’s necessarily like Ukraine with Russia, but they are quite heavily targeted [by one country].” Some higher-profile cases over time include a RedDelta campaign from 2023 to 2024, an unattributed