GopherWhisper APT Targets Mongolia Using Cloud Tools for Espionage

The Chinese APT group known as GopherWhisper has been identified as targeting the Mongolian government using multiple cloud-based tools for espionage. Active since November 2023, the group has backdoored at least 12 systems within a Mongolian governmental entity, with indications that dozens more may be affected. ESET researchers discovered various backdoors, including LaxGopher, JabGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor, each utilizing different command-and-control (C2) methods. These methods include leveraging Slack, Discord, Microsoft Outlook, and file.io for data exfiltration and communication. The sophistication of GopherWhisper's attacks is considered low, as they rely on a variety of less advanced tools rather than a single sophisticated exploit. The ongoing investigation highlights the group's unique focus on a region not typically targeted by other APTs. Current assessments suggest that while the group is active, the threat level remains moderate due to the lack of advanced attack techniques.

Key Points: • GopherWhisper APT has targeted Mongolian government systems since late 2023. • The group uses multiple cloud services for command-and-control operations. • At least 12 systems have been compromised, with potential for more victims.