LaxGopher

Reported Context (7)

that targeted a Mongolian governmental entity and deployed a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor. ESET Details GopherWhisper Malware Targeting Mongolian Government Entity
Dubbed LaxGopher, the backdoor uses Slack for C&C communication and can execute commands via command prompt, exfiltrate victim data, and fetch and execute additional payloads on the infected machines. ESET Details GopherWhisper APT’s Backdoors in Attacks on Mongolian Government
The group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development. ESET Finds GopherWhisper Backdoors in Mongolian Government Systems
The attackers deployed a Go-based backdoor called LaxGopher and a suite of tools — including RatGopher, SSLORDoor and CompactGopher — to maintain access and exfiltrate data to File.io, an operation consistent with ESET Uncovers China-Aligned GopherWhisper Campaign Targeting Mongolian Government
ESET linked the actor to China after recovering hardcoded credentials and thousands of Slack and Discord messages, and identified multiple Go-based backdoors including LaxGopher, RatGopher, and BoxOfFriends. ESET Links GopherWhisper to China After Uncovering Malware Toolkit

Malware (6)

People (2)

Threat Actors (6)

MITRE ATT&CK (15)

Vendors (2)

Products (7)

Tools (5)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.