cyber.hendryadrian.com
Security News · bleepingcomputer.com

ESET Links GopherWhisper to China After Uncovering Malware Toolkit

· Original article ↗

Summary

ESET reports that China-linked GopherWhisper has targeted government entities since at least 2023, using custom backdoors over Slack, Discord and Outlook. Telemetry showed 12 systems compromised at a Mongolian institution; C2 traffic indicated dozens more victims.

Key points

  • ESET says GopherWhisper has been active since at least 2023 and links the actor to China based on recovered communications and metadata.
  • Telemetry indicated 12 systems compromised at a Mongolian government institution; C2 traffic suggested dozens of additional victims, whose locations and sectors were unknown.
  • LaxGopher uses Slack for C2, RatGopher uses Discord, and BoxOfFriends uses Microsoft Graph API and Outlook.
  • Other identified tools include SSLORDoor, JabGopher, FriendDelivery and CompactGopher.
  • Researchers used hardcoded credentials to access attacker accounts and analyze 6,044 Slack messages and 3,005 Discord messages, including commands and uploaded files.
  • CompactGopher compresses collected data and uploads it to file[.]io.

Article Details

Event Type
ESET reported the discovery of GopherWhisper, a previously undocumented threat actor using custom malware and legitimate online services for command-and-control and data exfiltration.
Impact
ESET telemetry indicates 12 systems were compromised at a Mongolian government institution. C2 traffic suggested dozens of additional victims, but researchers lacked visibility into their locations and sectors. The actor used a custom tool to compress and upload stolen data to file.io.

MITRE ATT&CK

T1055 · Process InjectionJabGopher injects the LaxGopher backdoor into svchost.exe.T1059.003 · Windows Command ShellLaxGopher can execute retrieved commands using the Windows Command Prompt.T1102.002 · Bidirectional CommunicationThe backdoors used Slack, Discord, and Microsoft Graph API/Outlook for bidirectional command-and-control communications.T1105 · Ingress Tool TransferLaxGopher can download new payloads.T1567.002 · Exfiltration to Cloud StorageCompactGopher compressed stolen data and uploaded it to the file-sharing service file.io.

Threat Actors

GopherWhisperESET described GopherWhisper as a previously undocumented state-backed threat actor active since at least 2023. ESET linked the group to China based on recovered credentials, C2 messages, server metadata, and activity hours; this is an attribution by ESET.

Malware

BoxOfFriendsESET linked the actor to China after recovering hardcoded credentials and thousands of Slack and Discord messages, and identified multiple Go-based backdoors including LaxGopher, RatGopher, and BoxOfFriends.FriendDeliveryESET identified multiple implants and utilities: LaxGopher, RatGopher, BoxOfFriends, SSLORDoor, JabGopher, FriendDelivery, and CompactGopher, plus a file.io exfiltration tool.JabGopherESET identified multiple implants and utilities: LaxGopher, RatGopher, BoxOfFriends, SSLORDoor, JabGopher, FriendDelivery, and CompactGopher, plus a file.io exfiltration tool.LaxGopherESET linked the actor to China after recovering hardcoded credentials and thousands of Slack and Discord messages, and identified multiple Go-based backdoors including LaxGopher, RatGopher, and BoxOfFriends.RatGopherESET linked the actor to China after recovering hardcoded credentials and thousands of Slack and Discord messages, and identified multiple Go-based backdoors including LaxGopher, RatGopher, and BoxOfFriends.SSLORDoorESET identified multiple implants and utilities: LaxGopher, RatGopher, BoxOfFriends, SSLORDoor, JabGopher, FriendDelivery, and CompactGopher, plus a file.io exfiltration tool.

Vendors

Microsoftthreat actor called GopherWhisper has used a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord to conduct command-and-control and exfiltration against government

Products

Discordhas used a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord to conduct command-and-control and exfiltration against government entities.Microsoft 365 Outlookthreat actor called GopherWhisper has used a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord to conduct command-and-control and exfiltration against government entities.Microsoft GraphThe threat actor leverages Go-based tools and legitimate services (Slack, Discord, Microsoft Graph API/Outlook) for C2 and payload delivery.SlackGopherWhisper has used a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord to conduct command-and-control and exfiltration against government entities.

Tools

CompactGopherESET identified multiple implants and utilities: LaxGopher, RatGopher, BoxOfFriends, SSLORDoor, JabGopher, FriendDelivery, and CompactGopher, plus a file.io exfiltration tool.

Countries

ChinaESET linked the actor to China after recovering hardcoded credentials and thousands of Slack and Discord messages, and identified multiple Go-based backdoors including LaxGopher, RatGopher, and BoxOfFriends.MongoliaIn a campaign identified by cybersecurity company ESET, the threat actor targeted a government entity in Mongolia and deployed a malware set with multiple backdoors that used Slack, Discord, and the Microsoft Graph API

Industries

Governmentlike Microsoft 365 Outlook, Slack, and Discord to conduct command-and-control and exfiltration against government entities.

Related Articles