A newly identified China-aligned APT group dubbed GopherWhisper, attributed by cybersecurity company ESET, has been targeting Mongolian government institutions and other unidentified victims since at least 2023. Discovered by ESET in January 2025 via a new Go-based backdoor called LaxGopher, the group uses a custom toolkit written mostly in Go and abuses legitimate cloud services for command-and-control (C2) and exfiltration. GopherWhisper’s toolset includes multiple backdoors and loaders: LaxGopher (Slack-based C2, command execution, payload download), RatGopher (Discord-based C2), BoxOfFriends (Microsoft 365 Outlook/Graph API using draft emails for C2), SSLORDoor (C++ backdoor over raw TLS on port 443), JabGopher (injector for LaxGopher), FriendDelivery (loader for BoxOfFriends), and CompactGopher (file collector that compresses and exfiltrates data to file.io). ESET telemetry shows at least twelve (12) infected systems in a Mongolian government entity, while Slack and Discord C2 traffic suggests dozens more victims. By using hardcoded credentials, researchers accessed the attackers’ Slack, Discord, and Outlook infrastructure, reviewing more than 6,000 Slack and 3,000 Discord messages dating back to 2023. Timestamps, working-hour patterns in UTC+8, and zh-CN locale metadata support attribution to a China-based actor, reported by ESET. Indicators of Compromise (IOCs) have been published to help defenders detect and block this emerging threat, which CTIX analyst have attached in the ESET links below.