SSLORDoor

Reported Context (7)

toolset including LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and SSLORDoor. ESET Details GopherWhisper Malware Targeting Mongolian Government Entity
The APT also relies on a C++ backdoor called SSLORDoor, which uses OpenSSL BIO for communication via raw TCP sockets. ESET Details GopherWhisper APT’s Backdoors in Attacks on Mongolian Government
The group uses a variety of custom backdoors—LaxGopher, RatGopher, BoxOfFriends, CompactGopher, and SSLORDoor—that abuse mainstream cloud services for C2, indicating prolific but not highly sophisticated development. ESET Finds GopherWhisper Backdoors in Mongolian Government Systems
The attackers deployed a Go-based backdoor called LaxGopher and a suite of tools — including RatGopher, SSLORDoor and CompactGopher — to maintain access and exfiltrate data to File.io, an operation consistent with ESET Uncovers China-Aligned GopherWhisper Campaign Targeting Mongolian Government
ESET identified multiple implants and utilities: LaxGopher, RatGopher, BoxOfFriends, SSLORDoor, JabGopher, FriendDelivery, and CompactGopher, plus a file.io exfiltration tool. ESET Links GopherWhisper to China After Uncovering Malware Toolkit

Malware (6)

People (2)

Threat Actors (6)

MITRE ATT&CK (15)

Vendors (2)

Products (7)

Tools (5)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.