GopherWhisper: Unveiling a New China-Aligned APT Group Exploiting Collaboration Platforms
In January 2025, ESET researchers identified a previously undocumented China-aligned APT group named GopherWhisper targeting a Mongolian governmental institution. The group employs a suite of custom tools, primarily written in Go, including backdoors like LaxGopher, RatGopher, and BoxOfFriends, as well as the C++ backdoor SSLORDoor. GopherWhisper leverages legitimate services such as Discord, Slack, Microsoft 365 Outlook, and file.io for command and control (C&C) communications and data exfiltration. Analysis of C&C traffic from these platforms provided significant insights into the group's operations and post-compromise activities. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/?utm_source=openai)) This incident underscores the evolving tactics of APT groups in utilizing common collaboration platforms for malicious activities, highlighting the need for enhanced monitoring and security measures within such services to detect and mitigate potential threats.
Kill Chain
