TL;DR

ESET researchers disclosed GopherWhisper on April 23, 2026 — a previously undocumented China-aligned APT group that targeted Mongolian governmental institutions using a seven-tool arsenal, almost entirely written in Go. The group's signature: using legitimate SaaS platforms (Slack, Discord, Microsoft 365 Outlook) as command-and-control infrastructure, making their traffic nearly indistinguishable from normal enterprise communications. ESET extracted thousands of C&C messages directly from the attacker's operational Slack and Discord channels — a rare intelligence windfall caused by the operators' failure to clean up their own logs. GopherWhisper is active, espionage-oriented, and represents the maturation of a trend where APTs weaponize the enterprise SaaS stack itself.

---

Background: The Target and the Discovery

Mongolia occupies a unique geopolitical position. Landlocked between Russia and China, it holds significant deposits of coal, copper, and rare earth elements — resources that both neighbors covet. In 2025, as China intensified export controls over critical minerals [1] and competition for rare earths reshaped global supply chains, the motivation to monitor Mongolian government decision-making escalated sharply.

ESET researchers first detected GopherWhisper in January 2025, when an anomalous DLL — whisper.dll — appeared on the system of a Mongolian governmental entity. The file was being side-loaded by a legitimate executable, and its behavior was unusual: it was attempting to contact a private Slack server to retrieve commands. Digging further, ESET uncovered six additional tools operating across the same victim environment, all attributable to the same threat actor based on shared infrastructure and behavioral overlap.

The group was formally named GopherWhisper — derived from Go's gopher mascot and the whisper.dll filename that served as the initial discovery vector. ESET presented the full findings at Botconf 2026 on April 23, 2026. [2]

What makes the disclosure remarkable isn't just the toolset. It's what the operators left behind: thousands of undeleted messages in their own Slack and Discord servers, which ESET was able to extract after obtaining the hardcoded API tokens embedded in the malware samples. The attackers effectively narrated their own operation.

---

Technical Analysis

The Full Arsenal: Seven Tools, One Mission

GopherWhisper deployed a coordinated suite of malware across the victim environment. Understanding the full stack is essential to detecting it:

1. JabGopher (Injector)

The entry-point component. whisper.dll is side-loaded by a legitimate whisper.exe binary (the Whisper speech recognition tool). JabGopher reads an encrypted PE from its resource section (resource AAA, ID 101), decrypts it, and performs process hollowing into svchost.exe to execute LaxGopher from within a trusted system process. An execution guardrail requires the file C:\ProgramData\Microsoft\EdgeUpdate\Log\backup.log to exist before the injector proceeds — a basic sandbox/analyst detection check. Persistence is achieved via a Windows service masquerading as "Windows Push Notification Local Service."

2. LaxGopher (Primary Backdoor — Go)

The primary backdoor, operating over Slack. It connects to a private Slack server using the slack-go library with a hardcoded bot token. All messages are encrypted with AES-CFB-128, using the key ha,just_kidding! (the first 16 bytes serve as the IV). Activation requires the operator to send "How are you?" — the backdoor replies with I'm<computer_name>. Commands include remote command execution via cmd.exe, file upload/download, and lateral capability deployment.

3. CompactGopher (Exfiltration Tool — Go)

A purpose-built data harvesting utility. Given source and output directories plus optional time parameters, CompactGopher crawls the filesystem for .doc, .docx, .jpg, .xls, .xlsx, .txt, .pdf, .ppt, and .pptx files — the classic government document target set. Files are compressed, encrypted with AES-CFB-128 (key: korehappyhappyhappy+821054197565), and exfiltrated via the file.io REST API. This is operationally elegant: file.io is a widely used, legitimate file-sharing service whose traffic rarely triggers DLP alarms.

4. RatGopher (Secondary Backdoor — Go)

Functionally parallel to LaxGopher but using Discord as its C2 channel. The internal module name is Rat0813. Key derivation is more sophisticated: the AES-128 key is MD5(channel_ID) and the IV is MD5(user_ID). The activation handshake is Hello, everyone!\nI'm coming! with key rotation messages embedded in spoiler-tagged base64 strings (||<base64>||). Commands are integer-coded: 1001 initiates a cmd.exe session, 1002 executes commands, 2001/3001 handle downloads/uploads via file.io, and 4002 kills the agent.

5. SSLORDoor (C++ Backdoor)

The outlier — written in C++ rather than Go. SSLORDoor communicates over raw TCP port 443 using OpenSSL BIO (not HTTPS, just TLS-encapsulated bytes). Its C2 server was identified as 43.231.113[.]50 (Intelligent Tools hosting provider). The protocol uses XOR with 0x3F followed by obfuscated RC4 with key lsk2ksi9f. After 100 consecutive failed commands, the process exits — preventing stuck zombie sessions. SSLORDoor's command set includes drive enumeration, file operations, shell execution, socket proxying, and a thread message-passing mechanism.

6. FriendDelivery (Loader/Injector)

The second-stage loader for BoxOfFriends. wer.dll is side-loaded by a renamed copy of WerFault.exe (bdreinit.exe — masquerading as BitDefender). Persistence is via a Windows service named bdreinitsvc with description "Microsoft Defender Reinit Service." The payload is located by scanning for the raw data marker x2T$x.0i, then XOR-decrypted with 0x56, CRC32-validated, and injected into a legitimate help.exe process.

7. BoxOfFriends (Tertiary Backdoor — Go)

The most operationally sophisticated component. BoxOfFriends uses the Microsoft Graph API with a stolen Microsoft 365 OAuth token to communicate via draft email messages in Outlook. Commands arrive as drafts from operator-controlled accounts; responses are written back as new drafts. The encryption key is the last 8 characters of the MD5 hash of the victim machine's MAC address — uniquely fingerprinting each implant. The key is stored in the email subject line, making it available for decryption without secondary communication. Supported commands include selfdelete, cd, download, sleep, interval, portforward, and arbitrary shell execution via PowerShell/cmd.exe.

C2 Infrastructure Architecture: SaaS as Cover

The overarching theme across all seven tools is legitimate-service abuse for C2. This is not new — APT41, Lazarus, and others have used similar techniques — but GopherWhisper's multi-platform implementation is unusually comprehensive:

| Component | C2 Channel | Detection Difficulty |

|-----------|-----------|---------------------|

| LaxGopher | Slack API (HTTPS) | High |

| RatGopher | Discord WebSocket | High |

| BoxOfFriends | Microsoft Graph API / Outlook drafts | Very High |

| SSLORDoor | Raw TLS port 443 | Medium |

| CompactGopher | file.io REST API | High |

Each channel is separately authenticated with its own token. Burning one doesn't burn the others. The operators can pivot across C2 channels seamlessly — and all traffic blends into normal enterprise SaaS communications.

The Outlook draft technique deserves special attention. Draft emails that are never sent generate no SMTP traffic, no mail logs, and no outbound email indicators. Traditional email-based C2 detection relies on sent/received messages. Draft-only communication is effectively invisible to most email security products.

Attribution Evidence

ESET's attribution rests on three pillars:

1. Operational hours: Bulk of Slack and Discord messages sent between 08:00–17:00 UTC+8 — aligning with China Standard Time (CST). The Slack metadata locale was explicitly set to zh-CN.

2. Operator environment telemetry: Operators used a VMware virtual machine that was installed and first booted during a time window consistent with UTC+8 working hours.

3. No code overlap: All seven tools show no code-level similarity to any previously known threat actor's malware, and the TTPs have no documented overlap with any named group — establishing GopherWhisper as a genuinely new cluster rather than a rebrand.

The targeting of Mongolia — specifically governmental institutions with access to resource and diplomatic intelligence — is consistent with Chinese state intelligence collection priorities in the region.

---

IOCs / Indicators of Compromise

File Hashes (SHA-1)

| Hash | Filename | Component |

|------|----------|-----------|

| FA9E65E58EB8FA41FDE0A0A870B7D24B298026D9 | whisper.dll | JabGopher injector |

| 5A1BBB40C442B12594A913431F8C6757A3A66E8F | wer.dll | FriendDelivery loader |

| C72E7540D6F12D74D8E737B02F31568385F575D7 | temp001.exe | CompactGopher exfiltration |

| 57C2490E4DB194D3503EE85635FB1D6F26E8C534 | intelservice.exe | RatGopher backdoor |

| AD7E264EB08415871617E45F21D03F7D71E4C36F | delltool.exe | SSLORDoor backdoor |

| 926974FACFD0383C65458D6EF1F31FBB7C769E18 | (unnamed) | BoxOfFriends backdoor |

| 039EB329A173FCE7EFECA18611A8F2C0F7D24609 | rp.exe | Token impersonation tool |

| 716554DC580A82CC17A1035ADD302C0766590964 | wb.exe | WebBrowserPassView (NirSoft) |

Network IOCs

| Indicator | Type | Notes |

|-----------|------|-------|

| 43.231.113[.]50 | IP | SSLORDoor C2 server (Intelligent Tools hosting) |

| barrantaya.1010@outlook[.]com | Email | BoxOfFriends operator account |

| file.io | Domain | RatGopher / CompactGopher exfiltration endpoint |

File System IOCs

| Path | Component |

|------|-----------|

| C:\Program Files\Internet Explorer\whisper.dll | JabGopher |

| C:\ProgramData\Microsoft\EdgeUpdate\Log\backup.log | JabGopher execution guardrail |

| %APPDATA%\BitDifender\bdreinit.exe | FriendDelivery masquerade |

| %APPDATA%\BitDifender\wer.dll | FriendDelivery payload |

| C:\Program Files\Common Files\SSL\openssl.conf | SSLORDoor config |

| %LOCALAPPDATA%\Temp\aa1.bat | Cleanup script |

Persistence Service Names

• bdreinitsvc — "Microsoft Defender Reinit Service" (FriendDelivery)
• Windows Push Notification Local Service masquerade (JabGopher)

Crypto Keys (for detection engineering / decryption of captured traffic)

| Component | Algorithm | Key |

|-----------|-----------|-----|

| LaxGopher | AES-CFB-128 | ha,just_kidding! |

| CompactGopher | AES-CFB-128 | korehappyhappyhappy+821054197565 |

| SSLORDoor | XOR + RC4 | 0x3F / lsk2ksi9f |

| FriendDelivery payload | XOR | 0x56 |

| BoxOfFriends | XOR + RC4 | last 8 chars of MD5(MAC address) |

---

Lyrie Take

GopherWhisper is the blueprint for the next decade of government-grade espionage: zero custom infrastructure, maximum deniability.

The SaaS C2 model isn't new, but GopherWhisper executes it more completely than most documented groups. Five separate legitimate services — Slack, Discord, Microsoft Graph, file.io, and raw TLS — form an infrastructure stack that is:

• Resilient: Take down one C2 channel; four remain operational.
• Invisible: All traffic looks like corporate SaaS usage. No suspicious domains, no suspicious IPs (except SSLORDoor's raw server).
• Scalable: OAuth tokens are freely creatable. New Slack workspaces and Discord servers are free. Outlook accounts cost nothing.
• Compartmentalized: Each backdoor uses different credentials. Burning LaxGopher's token doesn't touch RatGopher or BoxOfFriends.

The Outlook draft-only communication channel is particularly alarming. Most DLP and email security products log sent/received messages. Draft-only C2 generates no outbound email records. The only log artifacts are Microsoft Graph API calls — which look identical to any Outlook mobile or web app sync.

The operators' OpSec failure — not clearing their Slack and Discord logs — is the only reason we have detailed TTPs. In a better-run campaign, ESET would have recovered malware samples but not the operational intelligence about which machines were compromised, what commands were issued, or what data was exfiltrated. The intelligence windfall here was a gift. Don't assume future GopherWhisper campaigns will repeat the mistake.

The Lyrie autonomous defense angle: This is precisely the threat class where machine-speed monitoring becomes non-negotiable. Human analysts cannot monitor SaaS API telemetry — Microsoft Graph audit logs, Slack enterprise grid exports, Discord bot traffic — at the volume and correlation depth needed to catch this in real time. Lyrie's behavioral analysis layer operates on exactly this telemetry, flagging anomalous Graph API patterns (draft-heavy, scheduled, MAC-fingerprinted encryption keys in subjects) before the first exfiltration completes.

---

Defender Playbook

Immediate Actions

1. Block 43.231.113[.]50 at perimeter for SSLORDoor C2 containment. Flag any historical outbound connections to this IP.

2. Hunt for the file system IOCs above using EDR. Priority: bdreinit.exe in %APPDATA% (unusual — legitimate BitDefender never installs there), backup.log in EdgeUpdate directory, whisper.dll in IE folder.

3. Check for bdreinitsvc service on all Windows endpoints. The service description "Microsoft Defender Reinit Service" is not a Microsoft service and should not exist.

4. Audit Microsoft Graph API access via Entra ID audit logs. Filter for applications with Mail.ReadWrite or Mail.Read scopes that are not sanctioned enterprise apps. Draft-heavy access patterns (many PATCH /messages/{id} calls with no sendMail calls) are a strong indicator.

Detection Rules

EDR / SIEM — Process Injection:

svchost.exe spawned with unusual parent process AND
parent process has loaded whisper.dll from non-standard path

EDR — DLL Side-loading:

wer.dll loaded from %APPDATA% path (not System32/SysWOW64) OR
whisper.dll loaded from "Program Files\Internet Explorer"

Network — SaaS C2:

alert tcp any any -> any 443 (
  msg:"GopherWhisper SSLORDoor C2";
  content:"43.231.113.50";
  sid:9900001;
)

Microsoft 365 / Entra ID:

• Alert on: MailItemsAccessed events from non-interactive service principals with no Send operations but repeated Update operations on draft items.
• Alert on: OAuth app consents for Mail.ReadWrite from apps registered outside your tenant.

YARA (CompactGopher exfiltration strings):

rule GopherWhisper_CompactGopher {
    strings:
        $s1 = "korehappyhappyhappy+821054197565" ascii
        $s2 = "sourcedir" ascii
        $s3 = ".docx" ascii
        $s4 = "file.io" ascii
    condition:
        3 of them
}

YARA (LaxGopher activation string):

rule GopherWhisper_LaxGopher {
    strings:
        $s1 = "ha,just_kidding!" ascii
        $s2 = "How are you?" ascii
        $s3 = "I'm" ascii
        $s4 = "slack-go" ascii
    condition:
        3 of them
}

Longer-Term Hardening

• Restrict Slack/Discord API outbound access to known enterprise bot tokens or block at CASB layer for non-approved workspaces.
• Implement Microsoft Graph API allowlisting: Sanctioned apps only; unknown app IDs accessing Mail APIs should trigger immediate investigation.
• Monitor for Go runtime characteristics in process memory: unusual goroutine stack patterns, CGO indicators in svchost, or Go garbage collector signatures in injected processes.
• Audit service names against Microsoft's known service list — fake "Defender" and "Push Notification" service names are a recurring masquerade vector.
• Enable Microsoft 365 Unified Audit Logging and ship to SIEM if not already. Specifically alert on FileAccessed, MailItemsAccessed, and SearchQueryInitiatedSharePoint operations from non-human service principals.

---

MITRE ATT&CK Coverage

| Tactic | Technique | Component |

|--------|-----------|-----------|

| Resource Development | T1583.006 — Web Services | Slack/Discord/file.io C2 infra |

| Persistence | T1543.003 — Windows Service | JabGopher, FriendDelivery |

| Persistence | T1574.002 — DLL Side-Loading | JabGopher (whisper.dll), FriendDelivery (wer.dll) |

| Defense Evasion | T1055.012 — Process Hollowing | JabGopher → svchost |

| Defense Evasion | T1036.005 — Match Legitimate Name | bdreinitsvc, bdreinit.exe |

| Defense Evasion | T1480 — Execution Guardrails | backup.log check (JabGopher) |

| Collection | T1119 — Automated Collection | CompactGopher |

| Exfiltration | T1567 — Exfiltration Over Web Service | file.io |

| Command & Control | T1102.002 — Bidirectional Web Service | Slack, Discord, Outlook drafts |

| Command & Control | T1573.001 — Symmetric Cryptography | AES-CFB-128, XOR, RC4 |

---

Sources

1. ESET Research, "GopherWhisper: A burrow full of malware," WeLiveSecurity, April 23, 2026 — https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/

2. ESET Press Release, GlobeNewswire, April 23, 2026 — https://www.globenewswire.com/news-release/2026/04/23/3279634/

3. ESET White Paper, "GopherWhisper: A burrow full of malware" (full IOC/MITRE list) — https://web-assets.esetstatic.com/wls/en/papers/white-papers/gopherwhisper-burrow-full-malware.pdf

4. The Diplomat, "Why China's Rare Earth Card Is Unlikely to Become a Lasting Geopolitical Lever," April 2026 — https://thediplomat.com/2026/04/why-chinas-rare-earth-card-is-unlikely-to-become-a-lasting-geopolitical-lever/

5. Australian Cyber Security Centre, "Defending against China-nexus covert networks of compromised devices," April 2026 — https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/defending-against-china-nexus-covert-networks-of-compromised-devices

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk