JabGopher

Reported Context (5)

entity and deployed a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor. ESET Details GopherWhisper Malware Targeting Mongolian Government Entity
An injector named JabGopher is used to execute the backdoor in the memory of a newly spawned instance of svchost.exe. ESET Details GopherWhisper APT’s Backdoors in Attacks on Mongolian Government
2, 2025, ESET researchers discovered two malware samples: a backdoor, “LaxGopher,” and its injector, “JabGopher.” One might reasonably expect, at that point, that they had a pretty good idea of how this threat actor was ESET Finds GopherWhisper Backdoors in Mongolian Government Systems
ESET identified multiple implants and utilities: LaxGopher, RatGopher, BoxOfFriends, SSLORDoor, JabGopher, FriendDelivery, and CompactGopher, plus a file.io exfiltration tool. ESET Links GopherWhisper to China After Uncovering Malware Toolkit
Loaders and injectors include JabGopher and FriendDelivery, while SSLORDoor provides a C++ remote-access backdoor. ESET Reports About 12 Mongolian Government Systems Infected by GopherWhisper

Malware (6)

People (2)

Threat Actors (6)

MITRE ATT&CK (14)

Vendors (2)

Products (7)

Tools (1)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.