Signal
China-linked GopherWhisper targets Mongolian government with Go-based backdoors
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-04-23 09:04 UTCUpdated 2026-04-23 16:03 UTC
rss
cveexploitsthreat_actorsmalwareincident_responsesecurity_policy
Source links open
Source links and full evidence are open here. Pro adds archive history, compare-over-time, alerts, exports, and workflow. Business adds Feed API integrations and team usage.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
A China-aligned advanced persistent threat group named GopherWhisper has infected at least 12 Mongolian government systems using a variety of Go-based backdoors. Discovered by ESET researchers, the group has been active since late 2023 and employs injectors and loaders to deploy malware.
Score total
1.28
Momentum 24h
4
Posts
4
Origins
4
Source types
1
Duplicate ratio
0%
Why now
- GopherWhisper’s activity was discovered recently, revealing new malware and tactics.
- Hardcoded credentials leak provides rare insight into attacker infrastructure and communications.
- Concurrent reports of Harvester group attacks underline persistent regional cyber threats.
Why it matters
- Highlights ongoing China-linked cyberespionage targeting government institutions in Mongolia.
- Exposes operational security flaws in threat actor malware, aiding defenders.
- Shows continued use of advanced stealth techniques in state-sponsored attacks across Asia.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- GopherWhisper has infected at least 12 Mongolian government systems using Go-based backdoors.
- The group used Slack and Discord for covert communications and left hardcoded credentials in malware, exposing internal operations.
- The Harvester group targets South Asian government and telecom sectors with Linux backdoors abusing Microsoft Graph API.
How sources frame it
- The Hacker News: neutral
Consolidated recent findings on China-linked cyberespionage against Mongolia, emphasizing malware details and operational security lapses.
All evidence
All evidence
China-linked hackers targeted Mongolian government using Slack, Discord for covert communications
The Record (Recorded Future News) · therecord.media · 2026-04-23 16:03 UTC
GoGra backdoor targets Linux, abuses Microsoft Graph API for stealthy attacks
SC Media · scworld.com · 2026-04-23 13:40 UTC
Unwary Chinese Hackers Hardcoded Credentials into Backdoors
BankInfoSecurity · bankinfosecurity.com · 2026-04-23 09:38 UTC
China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors
thehackernews · thehackernews.com · 2026-04-23 09:04 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 4Origin domains: 4Duplicates: -
Showing 4 / 4
Top publishers (this list)
- The Record (Recorded Future News) (1)
- SC Media (1)
- BankInfoSecurity (1)
- thehackernews (1)
Top origin domains (this list)
- therecord.media (1)
- scworld.com (1)
- bankinfosecurity.com (1)
- thehackernews.com (1)