GopherWhisper is a newly identified China-linked APT group that uses a variety of Go-based backdoors and custom tools to conduct espionage against government targets. Their malware leverages legitimate cloud and communication services for stealthy C&C and data exfiltration. Key tools include LaxGopher (Slack-based C&C), RatGopher (Discord-based C&C), BoxOfFriends (Microsoft Graph API-based), and SSLORDoor (C++ backdoor using OpenSSL BIO). The group employs DLL injection and process hollowing techniques to evade detection and execute payloads in memory. The campaign was uncovered through investigation of a Mongolian government breach, revealing infections on roughly 12 systems and likely additional victims. The group’s tactics, techniques, and procedures (TTPs) differ from known APTs, leading to its classification as a distinct entity.

The GopherWhisper APT enables unauthorized remote command execution, file enumeration, data exfiltration, and deployment of additional payloads on compromised government systems. The use of legitimate services for C&C complicates detection and response. The compromise of government entities poses risks to confidentiality and operational security. Approximately a dozen systems in a Mongolian government organization were confirmed infected, with potential wider targeting. There are no known exploits of software vulnerabilities involved; the threat is based on targeted intrusion and malware deployment.

No official patches or fixes apply as this is an APT campaign rather than a software vulnerability. Organizations should focus on detection and response measures tailored to the described tools and behaviors, including monitoring for unusual use of Slack, Discord, Microsoft Graph API, and file.io services for C&C activity. Network defenders should analyze memory for injected processes and unusual command prompt activity. Since the threat leverages legitimate services, enhanced monitoring and anomaly detection on these platforms is recommended. Vendor advisories do not indicate any 'no action required' status; thus, active defense and incident response are advised.