The China-linked threat actor GopherWhisper uses a custom Go-based toolkit, including backdoors like LaxGopher and RatGopher, to target government entities. The group's attack vector involves leveraging legitimate services such as Microsoft 365 Outlook, Slack, and Discord for command-and-control communication and file-sharing services like File.io for data exfiltration. Dozens of victims are suspected, with a confirmed campaign against a Mongolian government entity.
Data Security , Malware , Threat Intelligence GopherWhisper: China-linked hackers target governments with custom Go toolkit April 24, 2026 Share By SC Staff (Adobe Stock) Bleeping Computer reports that a sophisticated state-backed threat actor, identified as GopherWhisper, has been actively targeting government entities since at least 2023. This group, believed to be linked to China, employs a custom toolkit written in the Go programming language and utilizes legitimate services for its malicious operations. ESET research revealed GopherWhisper's tactics, which include deploying multiple Go-based backdoors like LaxGopher and RatGopher, along with a C++ backdoor named SSLORDoor. These tools leverage popular platforms such as Microsoft 365 Outlook, Slack, and Discord for command-and-control (C2) communication. The attackers also utilize a custom tool, CompactGopher, to compress and exfiltrate stolen data to file-sharing services like File.io. In one identified campaign, a Mongolian government entity was targeted, with dozens of other victims suspected based on C2 traffic analysis. Source: Bleeping Computer SC Staff Related Security Operations UK Biobank volunteer data appears on Alibaba SC Staff April 24, 2026 The discovery was revealed by UK technology minister Ian Murray in the House of Commons on Thursday, coinciding with Biobank's own confirmation of the data issue. Ransomware Trigona ransomware attackers use novel tool for data exfiltration Laura French April 24, 2026 The uploader_client.exe command-line utility allows for rapid and granular data theft. Encryption Now’s the time to get working on post-quantum cryptography Bassam Al-Khalidi April 23, 2026 Organizations getting started this year are on the right track – here’s a four step plan. Related Events Cybercast Beyond the Hype: The Cybersecurity Trends CISOs are Keeping an Eye on in 2026 On-Demand Event Cybercast Beyond the data perimeter: Why next-generation DSPM is the foundation for modern data security On-Demand Event Virtual Conference Securing the Future of Finance: Strategies to Counter Modern Cyber Threats On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware Bit Black Hat Business Email Compromise (BEC) Cipher Ciphertext Covert Channels Cryptanalysis Darknet Hybrid Attack You can skip this ad in 5 seconds