ESET Discovers China-Aligned GopherWhisper APT Using Slack and Discord to Target Government Systems

Analysis
GopherWhisper's use of hardcoded API credentials in its backdoors represents an operational security failure that allowed ESET to pivot from a single Mongolian government compromise to mapping dozens of additional victims, a tactical gift that rarely occurs in state-aligned APT campaigns. The seven-tool kit's exclusive use of Go and commercial collaboration platforms (Discord, Slack, Outlook) for command-and-control parallels the compromised-device infrastructure strategy documented in the allied AA26-113A advisory released the same day, suggesting a broader shift in Chinese state-aligned operations toward blending malicious traffic with legitimate enterprise communications. China attribution rests on work-hour analysis concentrated in UTC+8 rather than technical indicators, which is circumstantial but consistent with prior ESET methodology.