# GopherWhisper — China-Aligned APT Targeting Mongolian Government with Go-Based Burrow Malware Toolkit (LaxGopher, RatGopher, BoxOfFriends, SSLORDoor)

> ESET Research disclosed GopherWhisper, a previously undocumented China-aligned APT group active since November 2023 that has compromised approximately 12 systems at a Mongolian governmental institution using a purpose-built, Go-language malware family internally tracked as Burrow. The toolset — LaxGopher, RatGopher, BoxOfFriends, JabGopher, CompactGopher, FriendDelivery, and the C++ backdoor SSLORDoor — abuses Slack, Discord, Microsoft 365 Outlook (via Graph API draft messages), and file.io to hide command-and-control and exfiltration traffic inside legitimate SaaS flows.

- **Published:** 2026-04-24T12:00:00Z
- **Last reviewed:** 2026-04-24T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0419
- **ID:** TL-2026-0419
- **Severity:** HIGH
- **Category:** APT
- **Status:** MONITORING
- **Actor:** GopherWhisper (China)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GopherWhisper is a newly identified China-nexus cyberespionage cluster disclosed publicly by ESET Research on 2026-04-23. ESET first observed the intrusion in January 2025 when it recovered a previously undocumented Go backdoor named LaxGopher from a Mongolian governmental entity; retrospective hunting placed the earliest activity at approximately 16 November 2023. The group derives its name from the gopher mascot of the Go programming language, which underlies the majority of its custom tooling, and from the filename ''whisper.dll'' used to host the primary backdoor.

The Burrow toolset is a modular, SaaS-abusing espionage platform. JabGopher is a loader/injector that starts a suspended instance of svchost.exe and injects LaxGopher (delivered as whisper.dll) into it. LaxGopher polls a private Slack workspace for commands, executes them via cmd.exe, and posts results back as messages; it can also download additional payloads. RatGopher mirrors the LaxGopher design but swaps Slack for Discord. BoxOfFriends is a Go backdoor that uses the Microsoft Graph API to exchange commands through draft messages in an attacker-controlled Microsoft 365 Outlook mailbox — a technique that allows C2 to blend into legitimate Office 365 traffic. FriendDelivery is the malicious DLL responsible for loading and injecting BoxOfFriends. CompactGopher is a Go-based staging utility that enumerates files matching sensitive office-document extensions (.doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .txt, .jpg), compresses them into a ZIP archive, encrypts the archive with AES-CFB-128, and exfiltrates to the public file.io service. SSLORDoor is a C++ backdoor that uses OpenSSL BIO over a raw TCP socket on port 443 to implement drive enumeration, file read/write/delete/upload, and arbitrary command execution against a dedicated attacker-operated C2 IP.

Attribution to China is supported by ESET through multiple operational signals: message timestamps in the attacker-controlled Slack and Discord channels cluster into the 08:00–17:00 UTC+8 working window consistent with China Standard Time; Slack workspace locale and VMware virtual machine boot timestamps were configured for zh-CN / UTC+8; and the operators referenced well-known Chinese and open-source Go libraries (kardianos/service, NHAS/stab, kirinlabs/utils, wumansgy/goEncrypt) in development chatter. ESET analysed 6,044 Slack messages dating from 2024-08-21 and 3,005 Discord messages dating from 2023-11-16, which together indicate dozens of additional victims beyond the 12 Mongolian government hosts confirmed on the ground.

GopherWhisper''s tradecraft sits at the intersection of two defender-hostile trends: (1) heavy reliance on Go-compiled binaries that produce large, statically linked executables resistant to legacy signature detection, and (2) systematic abuse of sanctioned SaaS egress (Discord, Slack, Microsoft Graph, file.io) so that C2 and exfiltration traverse only well-known, allow-listed domains. Defenders cannot rely on IP/domain blocklists; detection requires behavioural analytics on service-account anomalies (unusual Graph API draft-message churn, Slack/Discord bot-token use from endpoints, large ZIP POSTs to file.io), plus endpoint controls on DLL sideload paths (whisper.dll, wer.dll) and suspicious svchost.exe injection.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.006 Acquire Infrastructure: Web Services
- T1585.002 Establish Accounts: Email Accounts
- T1587.001 Develop Capabilities: Malware
- T1588.002 Obtain Capabilities: Tool
- T1078 Valid Accounts
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1106 Native API
- T1569.002 System Services: Service Execution
- T1574.001 DLL
- T1543.003 Create or Modify System Process: Windows Service
- T1055 Process Injection
- T1055.001 Process Injection: Dynamic-link Library Injection
- T1055.002 Process Injection: Portable Executable Injection
- T1027 Obfuscated Files or Information
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1055.012 Process Hollowing
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1120 Peripheral Device Discovery
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1560.001 Archive Collected Data: Archive via Utility
- T1560.003 Archive Collected Data: Archive via Custom Method
- T1071.001 Application Layer Protocol: Web Protocols
- T1071.003 Application Layer Protocol: Mail Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1102.001 Web Service: Dead Drop Resolver
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1041 Exfiltration Over C2 Channel

## Sources

- [GopherWhisper: A burrow full of malware](https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/)
- [ESET Research discovers new China-aligned group, GopherWhisper](https://www.globenewswire.com/news-release/2026/04/23/3279634/0/en/ESET-Research-discovers-new-China-aligned-group-GopherWhisper-It-abuses-messaging-services-Discord-Slack-and-Outlook-to-spy.html)
- [ESET malware-ioc: gopherwhisper](https://github.com/eset/malware-ioc/tree/master/gopherwhisper)
- [China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors](https://thehackernews.com/2026/04/china-linked-gopherwhisper-infects-12.html)
- [New GopherWhisper APT group abuses Outlook, Slack, Discord for comms](https://www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/)
- [GopherWhisper APT group hides command and control traffic in Slack and Discord](https://www.helpnetsecurity.com/2026/04/23/gopherwhisper-apt-group/)
- [Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia](https://www.hendryadrian.com/chinese-apt-abuses-multiple-cloud-tools-to-spy-on-mongolia/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0419