GopherWhisper — Threat Actor Profile, Campaigns & Targets

Threat entity extracted from intelligence sources

Frequency
3
occurrences
First Seen
April 23, 2026
Last Seen
May 20, 2026

GopherWhisper is a apt_group tracked across 2 threat clusters and 3 intelligence report mentions on ThreatCluster. First observed April 23, 2026; most recent activity May 20, 2026.

Related Threat Clusters

  • Webworm APT Expands Operations to Europe with New Backdoors

    The China-aligned APT group Webworm has shifted its focus from Asia to Europe, targeting government organizations in Belgium, Italy, Poland, Serbia, and Spain during 2025. ESET researchers identified new backdoors,…

    12 articles · Updated May 20, 2026
  • GopherWhisper APT Targets Mongolia Using Cloud Tools for Espionage

    The Chinese APT group known as GopherWhisper has been identified as targeting the Mongolian government using multiple cloud-based tools for espionage. Active since November 2023, the group has backdoored at least 12…

    8 articles · Updated April 24, 2026

Recent Intelligence Reports

  • ESET Research discovers new China-aligned group, GopherWhisper: It abuses messaging ... — Eset · May 20, 2026
  • Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia — Darkreading · April 24, 2026
  • GopherWhisper APT group hides command and control traffic in Slack and Discord — Feeds2.Feedburner · April 23, 2026

CVSS v3.1 Breakdown