Loading malware…
LaxGopher is a custom Go-based backdoor used by the China-aligned threat group GopherWhisper. ESET first detected it in January 2025 on systems belonging to a governmental entity in Mongolia, where it was deployed on roughly a dozen systems; broader Slack and Discord C2 analysis suggested additional victims may exist. LaxGopher uses a private Slack workspace/channel for command and control, retrieving instructions and posting results back to the same channel. It can execute commands via cmd.exe/Command Prompt, upload files, download additional payloads or tools, and change its configured Slack token and channel ID. ESET reported that one payload delivered through LaxGopher was CompactGopher, a Go-based exfiltration utility that compresses, encrypts, and uploads files to file.io. LaxGopher’s hardcoded Slack configuration is decrypted with AES-CFB-128 using the key "ha,just_kidding!". In observed operations, JabGopher acted as its injector: a component side-loaded as whisper.dll by a legitimate whisper.exe, which checked for C:\ProgramData\Microsoft\EdgeUpdate\Log\backup.log, decrypted an embedded LaxGopher payload from PE resources, and injected it into a new svchost.exe process using process hollowing. Recovered Slack communications associated with LaxGopher mainly contained disk and file enumeration commands. The initial access vector for the infections is not available from the provided content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group’s toolset that we initially discovered includes the custom Go-based backdoors LaxGopher and RatGopher, the injector JabGopher, the exfiltration tool CompactGopher, and a C++ backdoor SSLORDoor.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
LaxGopher communicates via Slack, runs commands, and downloads payloads
LaxGopher, RatGopher, and SSLORDoor can enumerate all services running on a compromised host.
LaxGopher, RatGopher, and SSLORDoor can collect the hostname, OS version, and OS architecture of a compromised host.
Attackers continue to lean on everyday collaboration platforms to hide command and control traffic inside normal enterprise noise... running its operations through Slack workspaces, Discord servers, Outlook drafts, and the file.io sharing service.
LaxGopher, RatGopher, and BoxOfFriends use HTTPS for C&C communication.
GopherWhisper leverages Discord, Slack, Microsoft 365 Outlook, and file.io for C&C communications and exfiltration.
LaxGopher, RatGopher, and BoxOfFriends use Slack, Discord, and Microsoft Graph, respectively, for C&C infrastructure.
LaxGopher, RatGopher, and SSLORDoor can all download additional files/payloads.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Go-based backdoor used by GopherWhisper that is injected into svchost.exe, communicates via Slack, executes commands, and downloads additional payloads such as CompactGopher.
A Go-based backdoor used by the GopherWhisper threat actor for malicious operations and command-and-control via legitimate services.
A backdoor used by GopherWhisper that leverages Slack for command-and-control communications.
A Go-based backdoor that uses Slack for command-and-control to execute commands via cmd.exe, return results to a Slack channel, and download additional malware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.