ESET Details GopherWhisper APT’s Slack, Discord and Outlook C2
Summary
ESET researchers linked China-aligned GopherWhisper to an intrusion at a Mongolian government entity, documenting backdoors using Slack, Discord and Outlook drafts for C2, file exfiltration via file[.]io, and recovered operator messages supporting the investigation.
Key points
- ESET named GopherWhisper and linked it to an intrusion at a Mongolian governmental entity.
- The toolset includes Go-based backdoors LaxGopher, RatGopher and BoxOfFriends, plus the C++ backdoor SSLORDoor.
- LaxGopher uses Slack for C2, RatGopher uses Discord, and BoxOfFriends exchanges commands through Outlook drafts via Microsoft Graph; SSLORDoor communicates over encrypted port 443.
- JabGopher and FriendDelivery load backdoors in memory; CompactGopher packages selected files for exfiltration through file[.]io.
- ESET recovered thousands of Slack and Discord messages and Outlook drafts, including development logs and operational details.
- Message timestamps, Slack locale metadata and a virtual machine’s timestamps aligned with UTC+8, supporting—but not independently proving—the China-aligned attribution.
- The recovered records showed Slack and Discord environments were initially used for testing and later as live C2 channels across multiple compromised systems.
Article Details
- Attack Vectors
- LaxGopher retrieves commands from a private Slack workspace and posts results to the same channel; RatGopher uses a Discord channel similarly.
- BoxOfFriends exchanges commands through Outlook draft messages using the Microsoft Graph API.
- JabGopher and FriendDelivery load backdoors into memory; the article also describes a side-loaded component named whisper.dll.
- CompactGopher packages selected files and exfiltrates them through file.io.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
barrantaya[.]1010@outlook[.]com | Mailbox associated with BoxOfFriends operations; Outlook drafts from the account were recovered during the investigation. |
MITRE ATT&CK
T1083 · File and Directory DiscoveryThe Slack channel tied to LaxGopher contained disk and file enumeration commands.T1102.002 · Bidirectional CommunicationLaxGopher and RatGopher exchange commands and results through Slack and Discord, while BoxOfFriends uses Outlook drafts through Microsoft Graph.T1567.002 · Exfiltration to Cloud StorageCompactGopher sends selected files out through the file.io sharing service.T1574.002 · DLL Side-LoadingThe article describes whisper.dll as a side-loaded component associated with the group’s tooling.
People
Threat Actors
Malware
BoxOfFriendsThe group’s toolset is largely written in Go and includes backdoors LaxGopher, RatGopher, BoxOfFriends, plus a C++ backdoor SSLORDoor.LaxGopher#GopherWhisper #LaxGopherRatGopherThe group’s toolset is largely written in Go and includes backdoors LaxGopher, RatGopher, BoxOfFriends, plus a C++ backdoor SSLORDoor.SSLORDoorThe group’s toolset is largely written in Go and includes backdoors LaxGopher, RatGopher, BoxOfFriends, plus a C++ backdoor SSLORDoor.
Vendors
Products
Discordand loaders that hide command-and-control traffic inside popular collaboration platforms such as Slack, Discord, and Outlook drafts while exfiltrating data via file.io.Microsoft GraphEach backdoor uses a different legitimate service for C2: Slack for LaxGopher, Discord for RatGopher, Outlook drafts via Microsoft Graph for BoxOfFriends, and SSLORDoor communicates over port 443.Outlookthat hide command-and-control traffic inside popular collaboration platforms such as Slack, Discord, and Outlook drafts while exfiltrating data via file.io.Slackand loaders that hide command-and-control traffic inside popular collaboration platforms such as Slack, Discord, and Outlook drafts while exfiltrating data via file.io.
Tools
CompactGopherSupporting tools JabGopher and FriendDelivery load backdoors in memory and CompactGopher exfiltrates files through the file.io sharing service.FriendDeliverySupporting tools JabGopher and FriendDelivery load backdoors in memory and CompactGopher exfiltrates files through the file.io sharing service.JabGopherSupporting tools JabGopher and FriendDelivery load backdoors in memory and CompactGopher exfiltrates files through the file.io sharing service.