GopherWhisper: China's New APT Hides 7 Backdoors Inside Slack, Discord and Outlook
On April 23, 2026, ESET Research published the first complete technical profile of GopherWhisper — a previously undocumented China-aligned APT group that has evaded detection for at least three years by routing all command-and-control traffic through legitimate enterprise services that every corporate firewall is configured to allow. GopherWhisper operators do not use attacker-owned domains or bespoke C2 infrastructure. Instead, they send commands through private Slack channels, private Discord servers, and Microsoft 365 Outlook draft emails — making the group's C2 traffic structurally indistinguishable from normal enterprise communications at the network layer.
The toolkit ESET recovered is a purpose-built, seven-component Go-based arsenal: LaxGopher (Slack C2 backdoor), RatGopher (Discord C2 backdoor), BoxOfFriends (Outlook/Microsoft Graph API C2 backdoor), JabGopher (injector), CompactGopher (data exfiltration tool), FriendDelivery (DLL loader), and SSLORDoor (C++ fallback backdoor over raw OpenSSL sockets on port 443). The group's name draws on two elements: the Go programming language — whose mascot is a gopher — and whisper.dll, the DLL side-loaded by JabGopher into svchost.exe. ESET confirmed at least 12 compromised systems within a Mongolian government entity, and C2 traffic analysis — made possible because operators hardcoded credentials into their malware — revealed dozens of additional victims not yet publicly identified.
The GopherWhisper disclosure matters today for a reason that extends beyond a single APT profile: this is not an opportunistic threat exploiting a zero-day. It is the systematic operationalisation of a living-off-legitimate-services (LoLS) C2 technique at nation-state sophistication levels, purpose-built to neutralise the entire class of network-layer defences that most enterprise security programmes rely on. Every organisation that allows outbound Slack, Discord, or Microsoft 365 traffic — essentially every modern enterprise — has an architectural gap that GopherWhisper exploits by design. Understanding this threat actor is the first step to closing it.
GopherWhisper Origin and Chinese Attribution Evidence
ESET researchers attributed GopherWhisper to a China-aligned threat actor with high confidence based on multiple independent signals converging on a consistent picture. The most direct evidence came from an operational security failure: GopherWhisper operators hardcoded authentication credentials into the malware itself, allowing ESET to access the attacker-controlled Slack workspace and Discord server and recover the full history of C2 communications.
From the recovered infrastructure, ESET extracted 6,044 Slack messages dated from August 21, 2024 through the time of discovery, and 3,005 Discord messages from November 16, 2023 onward. Timestamp analysis of these messages showed operator activity concentrated between 8 AM and 5 PM UTC+8 — China Standard Time. The Slack client locale metadata for the attacker-controlled account was set to zh-CN, the simplified Chinese locale identifier used in the People's Republic of China. Virtual machine boot times recovered from the C2 session metadata were consistent with the same timezone. No other geographic or linguistic attribution signals contradicting Chinese origin were identified.
GopherWhisper does not appear in prior MITRE ATT&CK group naming, Google TAG cluster designations, or Mandiant APT numbering, indicating this is a newly identified actor. Tradecraft similarities to other China-aligned APTs targeting Central Asia and Mongolian government institutions were noted by ESET, but no formal cluster merge has been announced. No government indictment or APT designation has been issued. The targeting of a Mongolian government entity is consistent with Chinese intelligence collection priorities in Central Asia aligned with Belt and Road Initiative regional relationships.
MITRE ATT&CK TTP Mapping: How GopherWhisper Executes Each Phase
GopherWhisper's technique stack maps cleanly across initial access, execution, persistence, defense evasion, command-and-control, and exfiltration phases. The group's primary strength is defense evasion — specifically the systematic abuse of trusted enterprise platforms that network security tools are configured to trust, not inspect.
**Initial Access (TA0001):** The specific vector used against the Mongolian government target has not been publicly confirmed by ESET. DLL side-loading as the execution mechanism implies a prior persistent foothold, suggesting spear-phishing or watering-hole delivery of the initial dropper. This phase remains unconfirmed in published research.
**Execution & Persistence (TA0002/TA0003):** T1055.001 (Process Injection — DLL Injection) via JabGopher, which launches svchost.exe and injects LaxGopher as whisper.dll. T1059.003 (Windows Command Shell) is used by both LaxGopher and RatGopher to execute operator commands. T1574.002 (DLL Side-Loading) underpins the JabGopher and FriendDelivery mechanisms.
**Defense Evasion (TA0005):** T1102.002 (Web Service — Bidirectional Communication) is the central evasion technique — all C2 traffic passes through Slack, Discord, or Microsoft Graph API, which are whitelisted on enterprise firewalls. T1218 (Signed Binary Proxy Execution) via the use of svchost.exe as the injection host.
**Command and Control (TA0011):** Three parallel channels via T1102: Slack (LaxGopher), Discord (RatGopher), Microsoft Graph API Outlook drafts (BoxOfFriends), with SSLORDoor providing a direct TCP fallback on port 443.
**Exfiltration (TA0010):** T1048 (Exfiltration Over Alternative Protocol) — CompactGopher compresses targeted files and uploads via file.io, a legitimate public file-sharing service.
“By analyzing the C&C communications obtained from the attacker-operated Slack and Discord channels, we gained insight into the group's inner workings — including victim telemetry that extended well beyond the single government entity in our initial detection.”
— ESET Research, GopherWhisper disclosure, April 23, 2026
The Seven-Tool Arsenal: Infrastructure Built for Redundancy and Evasion
GopherWhisper's toolkit shows deliberate architectural redundancy: three separate backdoors operating three separate C2 channels ensure that losing access to any single platform does not sever operator control. The toolkit was purpose-built in Go — a language increasingly favoured by state-sponsored APTs for its cross-platform compilation, small binary size, and relative rarity in corporate endpoint detection signatures compared to C or C++.
LaxGopher connects to a private Slack workspace, polls designated channels for commands, executes them via cmd.exe, and posts results back to the same channel. RatGopher performs the identical function using a private Discord server. BoxOfFriends uses the Microsoft Graph API to read commands from draft emails in an attacker-controlled Outlook account and write results back to new draft emails — a technique that generates zero outbound email traffic, leaving no discoverable sent-mail trail. SSLORDoor is a C++ backdoor providing direct socket communication over port 443 using raw OpenSSL, serving as a fallback when cloud service routes are unavailable. CompactGopher handles exfiltration — compressing targeted files before uploading to file.io. JabGopher is the primary injector and FriendDelivery is the DLL loader for BoxOfFriends.
The Outlook C2 account barrantaya.1010@outlook.com was created July 11, 2024. FriendDelivery was compiled exactly 11 days later on July 22, 2024 — indicating rapid, structured operationalisation of new C2 infrastructure. Full IOCs including file hashes are published by ESET at github.com/eset/malware-ioc/tree/master/gopherwhisper.
| Artifact | Type | SHA-256 (Truncated) |
|---|---|---|
| barrantaya.1010@outlook.com | C2 Account | Attacker-controlled Outlook account used by BoxOfFriends for Microsoft Graph API draft-email C2; created July 11, 2024 |
| whisper.dll | Malware Artifact | LaxGopher backdoor DLL injected into svchost.exe by the JabGopher injector; key behavioural detection signal |
| file.io | Exfiltration Channel | Legitimate public file-sharing service abused by CompactGopher for compressed data exfiltration |
| Port 443 raw socket (non-TLS) | C2 Channel | SSLORDoor fallback C2 over raw OpenSSL sockets on port 443; distinct from standard HTTPS — look for certificate anomalies |
| github.com/eset/malware-ioc/tree/master/gopherwhisper | IOC Repository | ESET's full published IOC set including file hashes for all seven tools — import immediately into threat intelligence platforms |
Any instance of msimg32.dll found outside C:\Windows\System32 is an active IOC. Isolate the host immediately. Full hashes and IOC lists are available via the Cisco Talos GitHub repository.
Confirmed Campaigns and Operational Timeline
GopherWhisper's confirmed operational history spans at least 29 months, from the earliest recovered Discord C2 messages in November 2023 to the ESET public disclosure in April 2026. The group operated without any public detection or attribution during this entire period — a duration that reflects both the efficacy of the LoLS evasion approach and the absence of endpoint telemetry capable of detecting behavioural C2 patterns over trusted enterprise platforms.
The primary disclosed campaign targeted a government entity in Mongolia, where ESET confirmed 12 compromised systems. The access timeline reconstructed from C2 messages indicates persistent access to Mongolian government systems across multiple months, with operators issuing commands, running file enumeration across drive structures, and exfiltrating targeted materials through CompactGopher's file.io pipeline. C2 traffic analysis of the Discord and Slack servers revealed victim telemetry from "dozens" of additional compromised systems not yet publicly identified — indicating GopherWhisper's operational footprint extends substantially beyond the single confirmed case.
Initial Foothold
Suspected spear-phishing or watering-hole delivery (vector unconfirmed by ESET); DLL side-loading establishes initial execution on target host
Injection & Persistence
JabGopher launches svchost.exe and injects LaxGopher as whisper.dll; FriendDelivery loads BoxOfFriends for Outlook-based C2 redundancy
Multi-Channel C2
LaxGopher polls private Slack channel; RatGopher connects to private Discord server; BoxOfFriends reads Microsoft Graph API Outlook draft emails for operator commands
Reconnaissance
SSLORDoor performs drive enumeration and file system reconnaissance; operators identify high-value documents via file listing results posted to C2 channels
Data Collection & Staging
CompactGopher compresses targeted government documents into archives for exfiltration; files staged locally before upload
Exfiltration
CompactGopher uploads compressed archives to file.io; legitimate service traffic blends with enterprise file-sharing patterns at network perimeter
Current Targeting: Government Entities and Central Asian Intelligence Priorities
GopherWhisper's confirmed targeting centres on government entities in Central Asia, with Mongolia as the primary publicly disclosed victim. The choice of Mongolia aligns with documented Chinese intelligence collection priorities: Mongolia borders both China and Russia, maintains strategic independence between the two powers, and holds significant intelligence value for Beijing around diplomatic communications, mineral resource negotiations, and political positioning.
The "dozens of victims" identified via C2 traffic analysis have not been publicly attributed by ESET. Based on the targeting pattern and the operational resources invested in a three-platform C2 system, the additional victims are assessed with moderate confidence to include other Central Asian government entities, potentially diplomatic missions, or organisations with strategic intelligence value for Chinese state priorities. The use of Go-based backdoors with Slack and Discord C2 is also consistent with tradecraft observed in China-aligned APT operations against Western government contractors and defence industrial base targets — sectors that should treat GopherWhisper's IOC set as immediately relevant.
The [CyberAv3ngers IRGC campaign targeting PLC infrastructure across US critical infrastructure sectors](/blog/cyberav3ngers-irgc-iran-plc-critical-infrastructure) demonstrated that nation-state actors increasingly invest in purpose-built tooling for specific evasion objectives — GopherWhisper represents the same pattern of sustained state-sponsored investment in bespoke C2 infrastructure. The [North Korea supply chain campaign compromising 1,700 packages](/blog/north-korea-supply-chain-1700-packages) similarly showed the willingness of state actors to build out operational infrastructure over multi-year timelines without detection.
Detection and Threat Hunting Guidance for Defenders
GopherWhisper's LoLS C2 approach means traditional network-layer defences — domain blocklists, JA3 TLS fingerprinting, C2 framework signatures — provide no detection value. Effective detection requires process-level behavioural telemetry, specifically around what processes are making API calls to Slack, Discord, and Microsoft Graph API endpoints.
The key detection principle: Slack, Discord, and Microsoft Graph API connections from svchost.exe, rundll32.exe, or any non-standard application binary are anomalous and should trigger immediate investigation. These processes have no legitimate reason to initiate outbound connections to consumer messaging platforms. ESET's full IOC set at github.com/eset/malware-ioc/tree/master/gopherwhisper should be imported into all threat intelligence platforms as a first action.
Hunt for svchost.exe loading unsigned DLLs
Query EDR telemetry for svchost.exe processes loading DLLs from non-standard paths or unsigned DLLs. whisper.dll is the key artifact — add it as a named detection rule. Any svchost.exe loading an unexpected DLL from a user-writable directory warrants immediate investigation.
Alert on Slack/Discord API calls from non-browser processes
Create SIEM alerts for outbound connections to slack.com, discord.com, and discordapp.com API endpoints from any process other than legitimate Slack or Discord application binaries. C2 polling from injected processes generates consistent, low-volume, high-frequency API calls distinct from normal user activity.
Monitor Microsoft Graph API calls for draft-email patterns
BoxOfFriends communicates exclusively via Outlook draft emails — never sent mail. Alert on Microsoft Graph API calls to /me/mailFolders/Drafts from non-Outlook, non-approved application identities. Unusual service principals accessing draft email folders via Graph API are a high-fidelity indicator.
Block or inspect file.io uploads from endpoints
CompactGopher exfiltrates via file.io. Proxy logs showing POST requests to file.io from workstations — particularly compressed archive uploads — should trigger DLP alerts. Consider blocking file.io at the web proxy unless there is a documented business need.
Import ESET IOC set into threat intelligence platforms
ESET published complete file hashes, Outlook account identifiers, and network indicators at github.com/eset/malware-ioc/tree/master/gopherwhisper. Import into your SIEM, EDR, and network detection platforms immediately. Cross-reference against historical endpoint and proxy logs for retroactive hunt coverage.
Review outbound port 443 for non-TLS raw socket traffic
SSLORDoor communicates via raw OpenSSL sockets on port 443 — not standard HTTPS. SSL inspection at the perimeter may identify certificate anomalies or unusual handshake patterns from this fallback channel. Look for port 443 traffic with certificate chains not matching known Slack, Discord, or Microsoft infrastructure.
The bottom line
GopherWhisper APT is a China-aligned threat actor that has been actively compromising government networks for at least three years by routing all C2 traffic through Slack, Discord, and Microsoft 365 Outlook — platforms that enterprise firewalls are structurally configured to trust. ESET's April 23, 2026 disclosure is the first public attribution, but the group's C2 infrastructure reveals dozens of victims beyond the confirmed Mongolian government target. The detection gap is architectural, not technical: traditional network-layer controls provide zero visibility into this C2 technique. Defenders must prioritise process-level behavioural analytics, import ESET's full IOC set at github.com/eset/malware-ioc/tree/master/gopherwhisper into all detection platforms now, and hunt for svchost.exe loading unsigned DLLs — whisper.dll is the first IOC to query.
Frequently asked questions
Who is GopherWhisper APT?
GopherWhisper is a previously undocumented China-aligned advanced persistent threat group first disclosed by ESET Research on April 23, 2026. Active since at least November 2023, the group operates a seven-tool Go-based malware suite and routes all command-and-control traffic through legitimate enterprise services — Slack, Discord, and Microsoft 365 Outlook — to evade network-layer detection. It has confirmed victims in Mongolian government entities and dozens of additional unidentified targets.
What TTPs does GopherWhisper use?
GopherWhisper's key TTPs include DLL side-loading via JabGopher (injecting LaxGopher as whisper.dll into svchost.exe), bidirectional C2 over Slack (LaxGopher), Discord (RatGopher), and Microsoft Graph API Outlook draft emails (BoxOfFriends), data exfiltration via the legitimate file.io service using CompactGopher, and raw OpenSSL socket C2 on port 443 via the C++ backdoor SSLORDoor. These map to MITRE ATT&CK T1102.002 (Web Service C2 Abuse), T1055.001 (DLL Injection), and T1048 (Exfiltration Over Alternative Protocol).
Which sectors does GopherWhisper target?
Confirmed targeting focuses on government entities, with a Mongolian government institution confirmed as the primary disclosed victim. C2 traffic analysis revealed dozens of additional victims whose sectors and geographies have not been publicly named. The targeting of Mongolia is consistent with Chinese intelligence collection priorities in Central Asia, and the tradecraft aligns with broader China-aligned APT activity around the Belt and Road Initiative and regional diplomatic relationships.
How do I detect GopherWhisper activity on my network?
Detection focuses on behavioural signals rather than domain blocklists. Hunt for svchost.exe processes loading unsigned DLLs from non-standard paths (whisper.dll is the key indicator). Monitor for unusual outbound API calls to Slack, Discord, or Microsoft Graph API originating from non-browser, non-standard-application processes. Alert on file.io upload activity from workstations. ESET's full IOC set is published at github.com/eset/malware-ioc/tree/master/gopherwhisper and should be imported into your threat intelligence platform.
Has GopherWhisper been indicted or sanctioned?
No government indictment, formal APT designation, or sanctions have been issued against GopherWhisper or its operators as of April 26, 2026. ESET's disclosure is the first public attribution. The group does not appear in existing MITRE ATT&CK, Google TAG, or Mandiant cluster naming. Attribution to China is assessed with high confidence based on timezone metadata, zh-CN locale identifiers in C2 infrastructure, and targeting patterns — but has not been formally confirmed by any government authority.
How does GopherWhisper use Slack and Discord as C2 channels?
GopherWhisper's LaxGopher backdoor connects to a private Slack workspace controlled by the operators. It polls for commands posted in Slack channels, executes them via the Windows Command Prompt, and posts results back to the same channel. RatGopher performs an identical function using Discord. Because Slack and Discord traffic is encrypted, high-volume, and whitelisted by default on enterprise firewalls, the C2 traffic is effectively invisible to traditional network monitoring tools. ESET accessed the attacker's C2 accounts after finding hardcoded credentials in the malware samples.
What is the BoxOfFriends Outlook draft email backdoor?
BoxOfFriends is a Go-based backdoor that uses the Microsoft Graph API to communicate via Microsoft 365 Outlook. Operators write commands into draft emails in an attacker-controlled Outlook account. BoxOfFriends reads these drafts via the Graph API, executes the commands, and writes results back to new draft emails. Because no emails are ever sent — only drafted — there is no outbound email trail to detect. The Outlook account barrantaya.1010@outlook.com was created July 11, 2024 and used as a primary C2 node.
Why is GopherWhisper's use of legitimate services harder to block than traditional C2?
Traditional APT C2 infrastructure — attacker-owned domains, bulletproof hosting, Cobalt Strike beacons — can be blocked by domain blacklists and TLS fingerprinting. GopherWhisper's LoLS approach routes C2 through Slack, Discord, and Microsoft 365: enterprise-grade platforms with valid TLS certificates, massive legitimate traffic volumes, and whitelisted firewall rules in virtually every corporate environment. Blocking these platforms would disrupt business operations, making the evasion technique structurally difficult to remediate without process-level telemetry and behavioural analytics.
Sources & references
- BleepingComputer — New GopherWhisper APT group abuses Outlook, Slack, Discord for comms
- ESET WeLiveSecurity — GopherWhisper: A burrow full of malware
- The Hacker News — China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors
- GlobeNewswire — ESET Research discovers new China-aligned group GopherWhisper
- Help Net Security — GopherWhisper APT group hides C2 traffic in Slack and Discord
- ESET Malware IOC Repository — GopherWhisper IOCs
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities — CVSS scores, exploit status, and patch availability. The reference card your SOC team needs, free with your newsletter subscription.
No spam. Unsubscribe anytime.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.