Whispers in the Burrow: GopherWhisper, China's Newest APT, Is Using Your Slack and Discord as a Command Post

TL;DR: ESET has publicly exposed GopherWhisper, a previously undocumented China-aligned APT active since at least January 2025. The group built a seven-tool Go-dominant arsenal and tunneled all command-and-control traffic through legitimate cloud services — Slack, Discord, and Microsoft 365 Outlook draft emails — making traditional network-based detection nearly blind. Twelve confirmed systems at a Mongolian government entity were compromised; C2 log analysis suggests dozens more victims across unreported verticals.

---

Background: Another Gopher in the Machine

On April 23, 2026, ESET Research analyst Eric Howard took the stage at Botconf 2026 and introduced the security community to a threat actor no one had catalogued before. Named GopherWhisper — after Go's gopher mascot and a key malicious DLL filename, whisper.dll — the group represents the latest entry in China's growing portfolio of bespoke cyberespionage clusters: no code overlap with known threat actors, no TTP fingerprint matching existing attribution sets, and an operational security mindset that deliberately weaponizes enterprise collaboration infrastructure against defenders.

The discovery began eighteen months earlier. In January 2025, ESET's telemetry flagged an anomalous backdoor on a system belonging to a Mongolian government entity. That initial find — dubbed LaxGopher — unravelled into a full seven-tool ecosystem when analysts pulled the thread. ESET published its complete findings in a white paper titled "GopherWhisper: A Burrow Full of Malware," making April 23, 2026 the public disclosure date for an operator that had been running covert access since at least early 2025.

The geopolitical framing matters. Mongolia is sandwiched between two powers — Russia to the north, China to the south — and sits at the intersection of Belt and Road logistics, rare-earth mining concessions, and a democratic governance model that creates friction with Beijing. Chinese state-nexus APTs (Mustang Panda, APT40, Earth Preta) have targeted Mongolian entities before, typically for economic intelligence and political monitoring. GopherWhisper fits this pattern precisely: espionage-motivated, government-focused, and patient enough to operate undetected for over a year.

---

The Arsenal: Seven Tools, One Coherent Kill Chain

GopherWhisper's toolset is architecturally coherent — each component has a defined role, and together they form a complete post-exploitation framework purpose-built for long-dwell espionage. All but one component are written in Go, a language that has become a favorite for threat actors because stripped Go binaries are difficult to analyze and cross-compile readily for multiple platforms.

Stage 1: Initial Access and Injection

JabGopher is the entry point injector. It spawns a new instance of svchost.exe — a ubiquitous Windows process — and injects LaxGopher disguised as whisper.dll directly into its process memory. This classic process injection play leverages the legitimacy of a system process to hide malicious activity from casual process listing and many endpoint visibility tools that whitelist svchost.exe without parent-chain validation.

Stage 2: Primary Backdoors (Three Channels, Maximum Resilience)

GopherWhisper's operators made a deliberate architectural decision: never rely on a single C2 channel. They deployed three independent backdoors, each speaking to a different legitimate SaaS platform.

LaxGopher communicates via a private Slack workspace. It retrieves operator commands from a configured Slack channel, executes them through cmd.exe, and publishes stdout results back to the same channel. Secondary capability: downloading and executing additional payloads. This makes LaxGopher both a RAT and a dropper.

RatGopher is the Discord variant — functionally equivalent to LaxGopher but routing through a private Discord server. The dual-channel redundancy means that if one platform's API token is burned or the workspace is taken down, operators retain persistent access through the other.

BoxOfFriends takes the most creative approach: it uses the Microsoft Graph API to interact with a legitimate Microsoft 365 Outlook mailbox, communicating exclusively through draft email messages — never sending a single email. The C2 instructions sit in Drafts, the implant reads them, executes, writes results back as another draft. No emails traverse the network; there are no SMTP logs; standard email security tools see nothing. From a detection standpoint, the traffic is indistinguishable from a legitimate Microsoft 365 sync event.

SSLORDoor, the lone C++ outlier, operates differently. It uses OpenSSL BIO abstractions for raw socket communications on port 443, bypassing application-layer cloud APIs entirely. Capabilities include drive enumeration and full CRUD file operations (open, read, write, delete, upload). Its presence alongside the cloud-channel backdoors suggests it serves as a fallback for environments where outbound SaaS traffic is scrutinized.

Stage 3: Collection and Exfiltration

CompactGopher is the data collection tool. Deployed by LaxGopher's download capability, it compresses targeted files from the command line and automatically exfiltrates them to file.io, a legitimate file-sharing service. Using a third-party sharing site rather than infrastructure the operators own makes the exfiltration destination difficult to blocklist without collateral damage.

Stage 4: Secondary Loader

FriendDelivery is a malicious DLL that serves as a loader and injector for BoxOfFriends, completing the delivery chain for the Outlook-based backdoor.

---

Inside the C2: ESET Reads the Operators' Own Messages

Here is where GopherWhisper's operational security falls apart — and where the research gets genuinely remarkable. ESET analysts extracted the Slack and Discord API tokens hardcoded into LaxGopher and RatGopher respectively. With those tokens, they were able to pull thousands of messages from the operators' own C2 channels — because the operators never cleared the logs.

What did those messages reveal?

Attribution anchoring: Message timestamps clustered densely between 08:00–17:00 UTC+8, China Standard Time. Slack metadata confirmed the configured user locale was UTC+8. Combined, this provides the working-hours behavioral signature that ESET used to assess China-alignment. No other major APT cluster operates exclusively in this window with this degree of consistency.

Operator OPSEC failures: The Slack and Discord channels were initially used to test the backdoors' functionality before being repurposed as live C2 for actual victim machines — without clearing prior test messages. This means ESET observed raw debugging output, incomplete command runs, and error messages from the operators' own development environment, including evidence that at least one operator ran tests from a VMware virtual machine whose installation timestamp aligned with UTC+8.

Development intelligence: Among the test uploads, ESET found links to several Go GitHub repositories the operators apparently used as development references:

| Repository | Purpose |

|---|---|

| github.com/kardianos/service | Go daemon service management |

| github.com/NHAS/stab | Go x86/x64 process injection |

| github.com/kirinlabs/utils | Go encryption and compression |

| github.com/wumansgy/goEncrypt | Go encryption implementations |

The NHAS/stab repository is particularly notable — it is a legitimate red-team tool for Go-based process injection, suggesting GopherWhisper's developers leaned on the open-source offensive community as a scaffolding layer before building their proprietary injector (JabGopher).

---

Scope: Known Confirmed vs. Suspected Victims

ESET telemetry confirmed approximately 12 infected systems within the single identified Mongolian government entity. However, analysis of the C2 traffic patterns — commands issued to multiple distinct host identifiers across the Slack and Discord channels — indicates dozens of additional victims whose geographic location and sector affiliation ESET has not been able to determine. The implication: GopherWhisper is not a single-target operation. Mongolia may simply be the vector that exposed a broader campaign.

---

IOCs / Indicators

| Type | Value | Notes |

|---|---|---|

| DLL filename | whisper.dll | LaxGopher disguise, injected by JabGopher |

| Process | svchost.exe with anomalous parent | JabGopher injection pattern |

| Network | Slack API traffic from non-browser processes | LaxGopher C2 |

| Network | Discord API traffic from non-browser processes | RatGopher C2 |

| Network | Microsoft Graph API OAuth calls (mail drafts) | BoxOfFriends C2 |

| Network | Outbound connections to file.io | CompactGopher exfiltration |

| Network | Port 443 raw socket (OpenSSL BIO, non-TLS-handshake) | SSLORDoor fallback C2 |

| Behavior | cmd.exe spawned by injected svchost.exe | LaxGopher command execution |

| Timing | Operator activity window 08:00–17:00 UTC+8 | Attribution indicator |

ESET has published a full white paper with additional technical indicators at: web-assets.esetstatic.com/wls/en/papers/white-papers/gopherwhisper-burrow-full-malware.pdf

---

Lyrie Take: Living-Off-the-Cloud Is Now the Default Playbook

GopherWhisper is not an outlier — it is a confirmation. The living-off-the-cloud (LOTC) pattern, where adversaries route all C2 through vendor-trusted SaaS APIs, has been building for years. What GopherWhisper adds is architectural redundancy: three independent cloud channels (Slack, Discord, Outlook Graph API), each routable through TLS, each indistinguishable from legitimate enterprise traffic at the packet level. A perimeter firewall that blocks Slack breaks productivity across the entire organization. An enterprise that doesn't block it hands the attacker a permanent covert channel.

The Outlook draft-email technique deserves particular attention. It is conceptually similar to the technique Microsoft attributed to NOBELIUM (SVR) in 2021, where attackers used compromised cloud accounts to send phishing from trusted tenants. BoxOfFriends takes it further: no sending at all. The mailbox becomes a dead-drop dead letter box. Standard mail security products, DLP, and even Microsoft Defender for Office 365 don't alert on unread drafts written by an implant. This is a gap the industry has not adequately addressed.

The Go-dominant toolchain is a cross-industry signal. Go's compile-time static linking, minimal runtime dependencies, and cross-platform compilation make it ideal for threat actors who want to produce small, portable binaries that resist YARA signatures based on import table fingerprinting. We expect the LOTC+Go combination to dominate new APT tool development in 2026-2027.

Anti-rogue-AI relevance: Autonomous agents that interact with enterprise SaaS (Slack bots, Outlook integrations, Discord webhooks) represent the same attack surface in reverse: malicious actors can masquerade as legitimate SaaS integrations, or compromise OAuth tokens for agentic workflows to gain persistent covert access to AI-orchestrated systems. Lyrie's behavioral analysis engine treats anomalous SaaS API call patterns — not just endpoint process behavior — as first-class threat signals. GopherWhisper is exactly the threat model that motivated that design decision.

---

Defender Playbook

Immediate (0–48 hours):

1. Audit OAuth applications connected to your M365 tenant. Any app with Mail.ReadWrite scope on delegated or application permissions that isn't a known productivity tool is a BoxOfFriends candidate. Revoke and investigate.

2. Review Slack/Discord process parents. Alert on any non-browser process making Slack or Discord API calls (api.slack.com, discord.com/api). Legitimate workspace apps always spawn from browser or Electron contexts.

3. Hunt svchost.exe injection. Use EDR to identify svchost.exe instances where the parent process is not services.exe. JabGopher injection pattern is textbook but still effective against misconfigured endpoint tooling.

Short-term (1–2 weeks):

4. DLP for file.io. If file.io is not an approved data sharing destination, block it at the proxy and alert on DNS queries. CompactGopher's exfiltration path is one of the simplest IOC-to-block opportunities in this campaign.

5. Enable Microsoft Graph API audit logging. In Microsoft Purview / M365 Unified Audit Log, ensure Mail.ReadWrite API calls are logged and baseline normal application behavior. Anomalous Graph API calls to /me/messages?isDraft=true from non-approved app registrations are a BoxOfFriends signature.

6. Deploy Go binary behavioral detection. Go binaries have distinctive runtime patterns (goroutine scheduler, stack growth mechanisms). Behavioral rules catching these in unusual process contexts outperform static YARA for stripped samples.

Structural:

7. Zero-trust SaaS access. Implement API gateway controls that enforce allowlists for which internal applications and service accounts can call Slack/Discord/Graph APIs. Unexpected callers become detectable noise.

8. Assume multiple C2 channels. Incident response playbooks that assume a single C2 protocol will miss GopherWhisper-style redundant-channel architectures. IR scope should include all three SaaS platforms when one is confirmed.

---

Sources

1. ESET Research – "GopherWhisper: A Burrow Full of Malware" (WeLiveSecurity, April 23, 2026): https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/

2. ESET Research – White Paper: "GopherWhisper: A burrow full of malware" (PDF): https://web-assets.esetstatic.com/wls/en/papers/white-papers/gopherwhisper-burrow-full-malware.pdf

3. GlobeNewswire – ESET Press Release, April 23, 2026: https://www.globenewswire.com/news-release/2026/04/23/3279634/0/en/ESET-Research-discovers-new-China-aligned-group-GopherWhisper.html

4. BleepingComputer – "New GopherWhisper APT group abuses Outlook, Slack, Discord for comms," April 23, 2026: https://www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/

5. The Hacker News – "China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors," April 23, 2026: https://thehackernews.com/2026/04/china-linked-gopherwhisper-infects-12.html

6. Security Affairs – "GopherWhisper: new China-linked APT targets Mongolia with Go-based malware," April 26, 2026: https://securityaffairs.com/191318/apt/gopherwhisper-new-china-linked-apt-targets-mongolia-with-go-based-malware.html

---

Lyrie Verdict: GopherWhisper's three-channel SaaS C2 architecture — Slack, Discord, Outlook drafts — is a high-fidelity template for enterprise intrusions that bypass perimeter controls. The draft-email technique in particular represents a detection gap that most security stacks cannot close without behavioral API-layer monitoring. If your threat model includes Chinese state-nexus actors (and if you operate in any Belt and Road-adjacent sector, it should), auditing your OAuth application registry and SaaS API call patterns is not optional — it's overdue.

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk