ESET Uncovers China-Aligned GopherWhisper Campaign Targeting Mongolian Government
Summary
ESET reports that GopherWhisper, a China-aligned actor active since at least November 2023, targeted a Mongolian government entity with Go-based malware, used Discord, Slack and Outlook for command and control, and exfiltrated files via File[.]io.
Key points
- ESET discovered GopherWhisper in January 2025 after finding the previously unknown LaxGopher backdoor on a Mongolian government network.
- LaxGopher was deployed on roughly a dozen systems at the organization, according to ESET.
- The actor used Discord, Slack and Microsoft 365 Outlook to communicate with compromised systems and manage command and control.
- The group used custom-built tools including RatGopher, BoxOfFriends, JabGopher, FriendDelivery and SSLORDoor to maintain access.
- CompactGopher compressed files and uploaded them to File[.]io for exfiltration.
- ESET said the operation appears consistent with cyber espionage and that dozens of additional victims are likely, but their locations and sectors are unknown.
- ESET did not attribute the campaign to a specific entity.
Article Details
- Event Type
- Cyber espionage campaign targeting a Mongolian government entity, using custom malware and legitimate communication platforms for command and control.
- Impact
- LaxGopher was deployed on roughly a dozen systems at the targeted organization. The attackers used CompactGopher to compress and exfiltrate files to File.io. ESET assessed the operation as consistent with cyber espionage and said dozens of additional victims were likely, but their locations and sectors were not identified.
MITRE ATT&CK
Threat Actors
Malware
LaxGopherThe attackers deployed a Go-based backdoor called LaxGopher and a suite of tools — including RatGopher, SSLORDoor and CompactGopher — to maintain access and exfiltrate data to File.io, an operation consistent withSSLORDoorThe attackers deployed a Go-based backdoor called LaxGopher and a suite of tools — including RatGopher, SSLORDoor and CompactGopher — to maintain access and exfiltrate data to File.io, an operation consistent with
Products
Discordtracked as GopherWhisper, targeting a Mongolian government entity and using legitimate services such as Discord, Slack and Microsoft 365 Outlook to control compromised systems.Microsoft 365 Outlooktargeting a Mongolian government entity and using legitimate services such as Discord, Slack and Microsoft 365 Outlook to control compromised systems.Slackas GopherWhisper, targeting a Mongolian government entity and using legitimate services such as Discord, Slack and Microsoft 365 Outlook to control compromised systems.
Tools
BoxOfFriendsAttackers used a Go-based toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, FriendDelivery and SSLORDoor to maintain persistence.CompactGophera Go-based backdoor called LaxGopher and a suite of tools — including RatGopher, SSLORDoor and CompactGopher — to maintain access and exfiltrate data to File.io, an operation consistent with espionage.FriendDeliveryAttackers used a Go-based toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, FriendDelivery and SSLORDoor to maintain persistence.JabGopherAttackers used a Go-based toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, FriendDelivery and SSLORDoor to maintain persistence.RatGopherThe attackers deployed a Go-based backdoor called LaxGopher and a suite of tools — including RatGopher, SSLORDoor and CompactGopher — to maintain access and exfiltrate data to File.io, an operation consistent with