China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors

GopherWhisper, a China-linked APT group, infected 12 Mongolian government systems with Go-based backdoors.

• •Arsenal includes LaxGopher, RatGopher, CompactGopher, SSLORDoor, and BoxOfFriends backdoors.
• •Abuses Discord, Slack, Microsoft 365, and file.io for C&C communication and data exfiltration.
• •Targets specific file extensions, compresses them as ZIP, encrypts with AES-CFB-128 before exfiltration.
• •C&C activity during 8 AM-5 PM aligns with China Standard Time working hours.

This summary was automatically generated by AI based on the original article and may not be fully accurate.