China-linked hackers targeted Mongolian government using Slack, Discord for covert communications

GopherWhisper, a previously undocumented China-aligned threat actor active since at least November 2023, targeted a Mongolian government institution using custom Go-based tooling (LaxGopher and related loaders/injectors/backdoors) and abused legitimate services (Discord, Slack, Microsoft 365 Outlook, File.io) for command-and-control and data exfiltration; roughly a dozen systems were compromised and researchers suspect additional victims.