ESET Research discovers new China-aligned group, GopherWhisper: It abuses messaging services Discord, Slack, and Outlook to spy

ESET researchers have identified a previously unknown China-aligned advanced persistent threat (APT) group dubbed GopherWhisper, which has been conducting espionage operations against a governmental institution in Mongolia. The threat actors demonstrate sophisticated operational security by leveraging legitimate communication platforms including Discord, Slack, Microsoft 365 Outlook, and the file-sharing service file.io to conduct command and control activities and data exfiltration, making their malicious traffic harder to detect among normal business communications. The group's technical arsenal consists primarily of tools written in the Go programming language, featuring a modular approach that uses specialized injectors and loaders to deploy various backdoors depending on the target environment. This multi-layered approach allows GopherWhisper to maintain persistence and adapt their toolset based on the specific characteristics of compromised systems, representing a notable evolution in APT tactics that abuse trusted platforms to blend malicious activities with legitimate network traffic.