China-Linked GopherWhisper APT Hits 12 Mongolian Gov Systems Using Slack/Discord C2
ESET discovers a new espionage group abusing legitimate cloud services for command-and-control against strategically sensitive Mongolian targets.
ULAN BATOR, MN — Researchers at ESET have uncovered a sophisticated, China-aligned espionage campaign targeting the Mongolian government. The threat actor, dubbed GopherWhisper, has successfully infected at least 12 government systems since late 2023, utilizing a modular arsenal of Go-based malware.
What distinguishes GopherWhisper is its heavy reliance on "Living-off-the-Land" (LotL) cloud techniques. By hijacking legitimate communications platforms like Slack, Discord, and Microsoft 365 Outlook for its command-and-control (C2) infrastructure, the group has effectively bypassed traditional network monitoring that often white-lists these services.
Breach Audit: The GopherWhisper Toolkit
The infection chain typically begins with a specialized injector known as JabGopher, which side-loads the primary payload into legitimate system processes like svchost.exe. Once established, the core backdoor—LaxGopher—takes over operations. LaxGopher is a modular Go-based tool that retrieves instructions via private Slack API tokens and exfiltrates stolen data using the file.io sharing service to avoid raising red flags.
Geopolitical Context: Mongolia as a High-Value Target
Mongolia sits in a precarious geopolitical position as a landlocked buffer state between Russia and China. As a candidate for a deeper NATO partnership and a nation with significant mineral resources, its government systems are prime targets for nation-state espionage. GopherWhisper follows a long history of China-linked operations in the region, including previous campaigns attributed to Mustang Panda (APT27).
This operation highlights the persistent threat posed by China’s cyber apparatus, which increasingly favors modular, Go-based malware for its cross-platform compatibility and ease of development.
The CyberSignal Analysis
Signal 01 — The Cloud Stealth Advantage
By abusing Slack and Discord, GopherWhisper turns essential business tools into weapons. Security teams often struggle to block this traffic without disrupting legitimate operations. To counter this, organizations must move toward advanced living-off-the-land monitoring that inspects the intent of cloud API calls rather than just the destination.
Signal 02 — The Modular Evolution
The use of the Go programming language allows GopherWhisper to iterate rapidly. Their toolkit includes separate collectors, loaders, and backdoors, making it easier to swap out components if one is detected. This modularity is becoming a hallmark of sophisticated state-sponsored actors seeking long-term persistence in high-value networks.
