GopherWhisperThreat actor
GopherWhisper is a China-aligned APT that routes C2 traffic through legitimate enterprise platforms like Slack, Discord, and Microsoft 365 Outlook to evade detection. Its toolkit includes the LaxGopher backdoor for Slack, RatGopher for Discord, and CompactGopher for data exfiltration via file[.]io.From MISP Galaxy
Last reported 6 months ago, by ESET WeLiveSecurity (ES)2 reports
Suspected originChinaMISP Galaxy
ATT&CK techniques
1 technique · each with the sentence it comes from- T1055Process Injection
“Go local and remote process injections for x86 and x64.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
GopherWhisper: grupo APT alineado con China usó Discord y Slack para atacar organismos gubernamentales“GopherWhisper: grupo APT alineado con China usó Discord y Slack para atacar organismos gubernamentales”
-
GopherWhisper: A burrow full of malware“GopherWhisper: A burrow full of malware”
Indicators in its reports
named in the reports above- hxxps://github[.]com/kardianos/servicein 2 reports
- hxxps://github[.]com/NHAS/stabin 2 reports
- hxxps://github[.]com/kirinlabs/utilsin 2 reports
- hxxps://github[.]com/wumansgy/goEncryptin 2 reports
Copy these 4 indicators · defanged
Thanks — we review every report.