Back Feeds2.Feedburner

GopherWhisper APT group hides command and control traffic in Slack and Discord

Feeds2.Feedburner •Anamarija Pogorelec • April 23, 2026

Attackers continue to lean on everyday collaboration platforms to hide command and control traffic inside normal enterprise noise. A newly identified China-aligned APT group pushes that trend further, running its operations through Slack workspaces, Discord servers, Outlook drafts, and the file.io sharing service. GopherWhisper toolset overview ESET researchers have named the group GopherWhisper and tied it to an intrusion at a Mongolian governmental entity. The name draws on two elements: most of the group’s tooling … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GopherWhisper APT Targets Mongolia Using Cloud Tools for Espionage The Chinese APT group known as GopherWhisper has been identified as targeting the Mongolian government using multiple cloud-based tools for espionage. Active since November 2023, the group has backdoored at least 12 systems within a Mongolian governmental entity, with indications that dozens more may be affected. ESET researchers discovered various backdoors, including LaxGopher, JabGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor, each utilizing different command-and-control (C2) methods. These methods include leveraging Slack, Discord, Microsoft Outlook, and file.io for data exfiltration and communication. The sophistication of GopherWhisper's attacks is considered low, as they rely on a variety of less advanced tools rather than a single sophisticated exploit. The ongoing investigation highlights the group's unique focus on a region not typically targeted by other APTs. Current assessments suggest that while the group is active, the threat level remains moderate due to the lack of advanced attack techniques. 4 sources 60

Extracted Entities

GopherWhisper APT group hides command and control traffic in Slack and Discord

The full story

Extracted Entities

APT Groups (1)

Companies (2)

MITRE ATT&CK (1)

Platforms (2)