Malware
FriendDelivery
- First Reported
- Apr 23, 2026
- Latest Reported
- Apr 26, 2026
Reported Context (5)
- a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor. ESET Details GopherWhisper Malware Targeting Mongolian Government Entity
- backdoor that relies on the Microsoft Graph API for communication via draft Outlook messages, and the FriendDelivery DLL injector that loads it. ESET Details GopherWhisper APT’s Backdoors in Attacks on Mongolian Government
- 22, came yet another backdoor, “RatGopher.” March 5 unearthed a fourth backdoor, “BoxOfFriends,” and its loader, “FriendDelivery.” And on March 24, there was “SSLORDoor.” ESET Finds GopherWhisper Backdoors in Mongolian Government Systems
- ESET identified multiple implants and utilities: LaxGopher, RatGopher, BoxOfFriends, SSLORDoor, JabGopher, FriendDelivery, and CompactGopher, plus a file.io exfiltration tool. ESET Links GopherWhisper to China After Uncovering Malware Toolkit
- Loaders and injectors include JabGopher and FriendDelivery, while SSLORDoor provides a C++ remote-access backdoor. ESET Reports About 12 Mongolian Government Systems Infected by GopherWhisper
Malware (6)
People (2)
Threat Actors (6)
MITRE ATT&CK (14)
Vendors (2)
Products (7)
Tools (1)
Industries (1)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.