APT Group GopherWhisper Leverages Outlook, Slack, and Discord for C2 Against Government Entities

APT Group GopherWhisper Leverages Outlook, Slack, and Discord for C2 Against Government Entities

What Happened – A previously undocumented, China‑linked APT group dubbed GopherWhisper has been using a custom Go‑based toolkit that abuses legitimate SaaS platforms—Microsoft 365 Outlook, Slack, and Discord—for command‑and‑control (C2) communications. The campaign, uncovered by ESET, targets government bodies (e.g., a Mongolian agency) and employs multiple backdoors (LaxGopher, RatGopher, BoxOfFriends, etc.) that retrieve commands from private channels and exfiltrate data via file.io.

Why It Matters for TPRM –

• Third‑party SaaS services can be weaponised as covert C2 channels, bypassing traditional network‑perimeter detections.
• Hard‑coded credentials in the malware give attackers persistent access to vendor platforms, exposing any downstream supply‑chain relationships.
• Government‑level targeting signals a high‑risk threat landscape for any organisation that relies on the same collaboration tools.

Who Is Affected – Government and public‑sector organisations; any entity that uses Microsoft 365 Outlook, Slack, or Discord for internal communications and may be exposed to compromised third‑party accounts.

Recommended Actions –

• Review and rotate all service‑account credentials for Outlook, Slack, and Discord; enforce MFA where possible.
• Implement strict monitoring of outbound traffic to SaaS APIs and enforce least‑privilege scopes for service accounts.
• Conduct a supply‑chain risk assessment of any third‑party integrations that could be leveraged for C2.

Technical Notes – The toolkit consists of Go‑based backdoors (LaxGopher, RatGopher, BoxOfFriends) and a C++ socket backdoor (SSLORDoor). C2 is conducted via Microsoft Graph API (draft‑email manipulation), private Slack workspaces, and Discord channels. Exfiltration uses the public file‑sharing service file.io. Researchers recovered >6,000 Slack messages and >3,000 Discord messages, confirming the use of hard‑coded credentials and linking the actors to China. Source: BleepingComputer