Signal

China-linked GopherWhisper targets Mongolian government with Go-based backdoors

Evidence first: scan the strongest sources, then decide whether to go deeper.

Published 2026-04-23 09:04 UTCUpdated 2026-04-23 16:03 UTC
rss
cveexploitsthreat_actorsmalwareincident_responsesecurity_policy
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.
4 top sources shown
Overview

A China-aligned advanced persistent threat group named GopherWhisper has infected at least 12 Mongolian government systems using a variety of Go-based backdoors. Discovered by ESET researchers, the group has been active since late 2023 and employs injectors and loaders to deploy malware.

Score total
1.28
Momentum 24h
4
Posts
4
Origins
4
Source types
1
Duplicate ratio
0%
Why now
  • GopherWhisper’s activity was discovered recently, revealing new malware and tactics.
  • Hardcoded credentials leak provides rare insight into attacker infrastructure and communications.
  • Concurrent reports of Harvester group attacks underline persistent regional cyber threats.
Why it matters
  • Highlights ongoing China-linked cyberespionage targeting government institutions in Mongolia.
  • Exposes operational security flaws in threat actor malware, aiding defenders.
  • Shows continued use of advanced stealth techniques in state-sponsored attacks across Asia.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
  • GopherWhisper has infected at least 12 Mongolian government systems using Go-based backdoors.
  • The group used Slack and Discord for covert communications and left hardcoded credentials in malware, exposing internal operations.
  • The Harvester group targets South Asian government and telecom sectors with Linux backdoors abusing Microsoft Graph API.
How sources frame it
  • The Hacker News: neutral
Consolidated recent findings on China-linked cyberespionage against Mongolia, emphasizing malware details and operational security lapses.
All evidence
All evidence
China-linked hackers targeted Mongolian government using Slack, Discord for covert communications
The Record (Recorded Future News) · therecord.media · 2026-04-23 16:03 UTC
Unwary Chinese Hackers Hardcoded Credentials into Backdoors
BankInfoSecurity · bankinfosecurity.com · 2026-04-23 09:38 UTC
China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors
thehackernews · thehackernews.com · 2026-04-23 09:04 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 4Origin domains: 4Duplicates: -
Showing 4 / 0
Top publishers (this list)
  • The Record (Recorded Future News) (1)
  • SC Media (1)
  • BankInfoSecurity (1)
  • thehackernews (1)
Top origin domains (this list)
  • therecord.media (1)
  • scworld.com (1)
  • bankinfosecurity.com (1)
  • thehackernews.com (1)