Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia

GopherWhisper, a Chinese-aligned APT active since November 2023, targeted Mongolian government networks using multiple custom backdoors that abuse mainstream cloud services (Slack, Discord, Outlook drafts, file.io) for C2 and exfiltration; ESET identified at least 12 infected systems in one government institution and evidence of broader impact, noting the group's high rate of tool development but relatively modest sophistication.