GopherWhisper — China-Aligned APT Targeting Mongolian Government with Go-Based Burrow Malware Toolkit (LaxGopher, RatGopher, BoxOfFriends, SSLORDoor)
GopherWhisper (TL-2026-0419), also tracked as Burrow, is a high-severity advanced persistent threat campaign, first published 2026-04-24. It is attributed to GopherWhisper (China) with high confidence, affects Microsoft Windows, maps to 35 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0419
- Threat ID
- TL-2026-0419
- Also known as
- Burrow, GopherWhisper APT
- Severity
- HIGH
- Status
- MONITORING
- Category
- APT
- First published
- 2026-04-24
- Last reviewed
- 2026-04-24
- Attribution
- GopherWhisper
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government, public-administration, diplomatic
- Target regions
- Mongolia, East Asia, Central Asia
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in GopherWhisper
Malware and tooling: BoxOfFriends, CompactGopher, FriendDelivery, JabGopher, LaxGopher, RatGopher, SSLORDoor, Burrow (custom GopherWhisper toolset), WebBrowserPassView
ESET Research disclosed GopherWhisper, a previously undocumented China-aligned APT group active since November 2023 that has compromised approximately 12 systems at a Mongolian governmental institution using a purpose-built, Go-language malware family internally tracked as Burrow. The toolset — LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and the C++ backdoor SSLORDoor — abuses Slack, Discord, Microsoft 365 Outlook (via Graph API draft messages), and file.io to hide command-and-control and exfiltration traffic inside legitimate SaaS flows.
How GopherWhisper works
GopherWhisper is a newly identified China-nexus cyberespionage cluster disclosed publicly by ESET Research on 2026-04-23. ESET first observed the intrusion in January 2025 when it recovered a previously undocumented Go backdoor named LaxGopher from a Mongolian governmental entity; retrospective hunting placed the earliest activity at approximately 16 November 2023. The group derives its name from the gopher mascot of the Go programming language, which underlies the majority of its custom tooling, and from the filename ''whisper.dll'' used to host the primary backdoor.
The Burrow toolset is a modular, SaaS-abusing espionage platform. JabGopher is a loader/injector that starts a suspended instance of svchost.exe and injects LaxGopher (delivered as whisper.dll) into it. LaxGopher polls a private Slack workspace for commands, executes them via cmd.exe, and posts results back as messages; it can also download additional payloads. RatGopher mirrors the LaxGopher design but swaps Slack for Discord. BoxOfFriends is a Go backdoor that uses the Microsoft Graph API to exchange commands through draft messages in an attacker-controlled Microsoft 365 Outlook mailbox — a technique that allows C2 to blend into legitimate Office 365 traffic. FriendDelivery is the malicious DLL responsible for loading and injecting BoxOfFriends. CompactGopher is a Go-based staging utility that enumerates files matching sensitive office-document extensions (.doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .txt, .jpg), compresses them into a ZIP archive, encrypts the archive with AES-CFB-128, and exfiltrates to the public file.io service. SSLORDoor is a C++ backdoor that uses OpenSSL BIO over a raw TCP socket on port 443 to implement drive enumeration, file read/write/delete/upload, and arbitrary command execution against a dedicated attacker-operated C2 IP.
Attribution to China is supported by ESET through multiple operational signals: message timestamps in the attacker-controlled Slack and Discord channels cluster into the 08:00–17:00 UTC+8 working window consistent with China Standard Time; Slack workspace locale and VMware virtual machine boot timestamps were configured for zh-CN / UTC+8; and the operators referenced well-known Chinese and open-source Go libraries (kardianos/service, NHAS/stab, kirinlabs/utils, wumansgy/goEncrypt) in development chatter. ESET analysed 6,044 Slack messages dating from 2024-08-21 and 3,005 Discord messages dating from 2023-11-16, which together indicate dozens of additional victims beyond the 12 Mongolian government hosts confirmed on the ground.
GopherWhisper''s tradecraft sits at the intersection of two defender-hostile trends: (1) heavy reliance on Go-compiled binaries that produce large, statically linked executables resistant to legacy signature detection, and (2) systematic abuse of sanctioned SaaS egress (Discord, Slack, Microsoft Graph, file.io) so that C2 and exfiltration traverse only well-known, allow-listed domains. Defenders cannot rely on IP/domain blocklists; detection requires behavioural analytics on service-account anomalies (unusual Graph API draft-message churn, Slack/Discord bot-token use from endpoints, large ZIP POSTs to file.io), plus endpoint controls on DLL sideload paths (whisper.dll, wer.dll) and suspicious svchost.exe injection.
MITRE ATT&CK techniques used in TL-2026-0419
Collection
T1005 Data from Local System; T1560.001 Archive Collected Data: Archive via Utility; T1560.003 Archive Collected Data: Archive via Custom Method
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1120 Peripheral Device Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1055.001 Process Injection: Dynamic-link Library Injection; T1055.002 Process Injection: Portable Executable Injection; T1055.012 Process Hollowing
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Privilege Escalation
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1106 Native API; T1569.002 System Services: Service Execution
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1071.003 Application Layer Protocol: Mail Protocols; T1095 Non-Application Layer Protocol; T1102.001 Web Service: Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Encrypted Channel: Asymmetric Cryptography
Initial Access
Persistence
T1543.003 Create or Modify System Process: Windows Service
Credential Access
T1555.003 Credentials from Password Stores: Credentials from Web Browsers
stealth
Resource Development
T1583 Acquire Infrastructure; T1583.006 Acquire Infrastructure: Web Services; T1585.002 Establish Accounts: Email Accounts; T1587.001 Develop Capabilities: Malware; T1588.002 Obtain Capabilities: Tool
Affected products and versions in GopherWhisper
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016+ - Microsoft — Microsoft 365 Outlook / Graph API
Vulnerable versions: All tenants with permissive Graph application consent - Slack Technologies — Slack Workspaces
Vulnerable versions: All workspaces reachable from compromised endpoints - Discord — Discord Servers / Bot API
Vulnerable versions: All accounts reachable from compromised endpoints - file.io — file.io Sharing Service
Vulnerable versions: Public API endpoint
Remediation for GopherWhisper
Immediate actions
- Block outbound connections to 43.231.113.50/32 at perimeter and egress proxies
- Hunt for whisper.dll and wer.dll on disk outside of legitimate Windows Error Reporting paths
- Audit Microsoft 365 tenants for Graph API application/service principals with Mail.ReadWrite or Mail.Send permissions that have high draft-message creation/modification rates
- Review Slack and Discord egress telemetry for bot-token activity originating from user endpoints rather than sanctioned chat clients
- Quarantine and forensically image the 8 SHA-1 samples listed below if discovered on any host
- Search for ZIP POSTs to file.io from non-browser processes and any cmd.exe child processes spawned by svchost.exe
Workarounds
- Disable Discord and Slack web/desktop clients on high-risk endpoints via browser allowlist and application control
- Restrict Microsoft Graph application permissions to explicitly enumerated publishers
- Deploy egress SSL inspection to surface non-browser TLS clients such as SSLORDoor on TCP/443
Longer-term hardening
- Deploy EDR with behavioural rules for process-hollowing/injection into svchost.exe from non-system parents
- Enforce DLL allowlisting or signed-DLL policies to prevent sideloading of whisper.dll and wer.dll
- Establish Graph API tenant-wide conditional access and anomaly detection for draft-message-only mailboxes
- Block or egress-inspect access to file.io from enterprise networks; require DLP review of outbound archive uploads
- Segment government and sensitive-sector networks to limit Go-backdoor lateral movement once a beachhead is established
- Subscribe to ESET and CERT-MN threat feeds for IOC updates on the Burrow toolset
Weaknesses (CWE) in GopherWhisper
CWE-506, CWE-829
Timeline of GopherWhisper
- Earliest GopherWhisper Discord C2 message observed by ESET telemetry, indicating the campaign''s operational start.
- Attacker-controlled Microsoft 365 Outlook account barrantaya.1010@outlook.com is created to support BoxOfFriends Graph API draft-message C2.
- FriendDelivery loader DLL compiled 11 days after the Outlook account registration, tying the account to Burrow toolset development.
- Earliest of 6,044 attacker Slack messages analysed by ESET from the LaxGopher private workspace.
- ESET telemetry flags LaxGopher (whisper.dll) on a Mongolian governmental entity for the first time, initiating the investigation.
- SSLORDoor C2 IP 43.231.113.50 (hosted on Intelligent Tools) first observed receiving raw-socket traffic on TCP/443.
- ESET Research publicly discloses GopherWhisper and the Burrow toolset in the WeLiveSecurity research report and companion GitHub IOC repository.
- Threadlinqs Intelligence publishes TL-2026-0419 with consolidated IOCs, MITRE mapping, and detections for Burrow toolset.
- As of 2026-05-29, GopherWhisper remains a live China-nexus espionage concern: ESET only disclosed it on 2026-04-23, no CVEs apply, and there are no public takedowns, arrests, or sinkholes. The actor (active since Nov 2023, dozens of likely victims) and its SaaS-abusing Burrow toolkit/C2 43.231.113.50 persist, though post-disclosure exposure may force infra rotation.
Sources cited for GopherWhisper
- GopherWhisper: A burrow full of malware
- ESET Research discovers new China-aligned group, GopherWhisper
- ESET malware-ioc: gopherwhisper
- China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors
- New GopherWhisper APT group abuses Outlook, Slack, Discord for comms
- GopherWhisper APT group hides command and control traffic in Slack and Discord
- Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia
Threats related to GopherWhisper
Detection coverage for TL-2026-0419
As of 2026-04-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0419 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.