RatGopher

Reported Context (6)

targeted a Mongolian governmental entity and deployed a diverse Go-centric toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor. ESET Details GopherWhisper Malware Targeting Mongolian Government Entity
Another tool in GopherWhisper’s arsenal is RatGopher, a Go-based backdoor. ESET Details GopherWhisper APT’s Backdoors in Attacks on Mongolian Government
The group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development. ESET Finds GopherWhisper Backdoors in Mongolian Government Systems
ESET linked the actor to China after recovering hardcoded credentials and thousands of Slack and Discord messages, and identified multiple Go-based backdoors including LaxGopher, RatGopher, and BoxOfFriends. ESET Links GopherWhisper to China After Uncovering Malware Toolkit
The group’s toolset is largely written in Go and includes backdoors LaxGopher, RatGopher, BoxOfFriends, plus a C++ backdoor SSLORDoor. ESET Details GopherWhisper APT’s Slack, Discord and Outlook C2

Malware (6)

People (2)

Threat Actors (6)

MITRE ATT&CK (15)

Vendors (2)

Products (7)

Tools (3)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.