GopherWhisper APT Targets Mongolia Using Cloud Tools for Espionage

• •GopherWhisper APT has targeted Mongolian government systems since late 2023.
• •The group uses multiple cloud services for command-and-control operations.
• •At least 12 systems have been compromised, with potential for more victims.

The Chinese APT group known as GopherWhisper has been identified as targeting the Mongolian government using multiple cloud-based tools for espionage. Active since November 2023, the group has backdoored at least 12 systems within a Mongolian governmental entity, with indications that dozens more may be affected. ESET researchers discovered various backdoors, including LaxGopher, JabGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor, each utilizing different command-and-control (C2) methods. These methods include leveraging Slack, Discord, Microsoft Outlook, and file.io for data exfiltration and communication. The sophistication of GopherWhisper's attacks is considered low, as they rely on a variety of less advanced tools rather than a single sophisticated exploit. The ongoing investigation highlights the group's unique focus on a region not typically targeted by other APTs. Current assessments suggest that while the group is active, the threat level remains moderate due to the lack of advanced attack techniques.